File name:

KMSAuto Net.exe

Full analysis: https://app.any.run/tasks/793309c4-27fc-4b7b-8286-6816557f5a1a
Verdict: Malicious activity
Analysis date: March 23, 2025, 13:24:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
kms
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

311F3BAA9BFA5B2364FEA8B254D15EB9

SHA1:

992585B81ACACCDB5C89361CDD1C1FD25E0C5CA1

SHA256:

BEA219F0F08ED083677A0B869E658BA09785F470668EADC659DB2885FA89F3B9

SSDEEP:

196608:OwywCAfywOwe/3ywuywQywTyw3ywsywsywPbywgsywZywtywRywZywBywFywUywO:owCAqwUqwjwNw2wiwxwxwPewgxwUwQwN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KMSAuto Net.exe (PID: 2284)
      • certmgr.exe (PID: 5780)
      • certmgr.exe (PID: 1168)
      • KMSSS.exe (PID: 7084)
      • FakeClient.exe (PID: 2984)
      • certmgr.exe (PID: 2852)
      • certmgr.exe (PID: 2092)
      • certmgr.exe (PID: 6960)
      • certmgr.exe (PID: 4348)
      • KMSSS.exe (PID: 5780)
      • FakeClient.exe (PID: 3300)

    • Opens a text file (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1512)

  • SUSPICIOUS

    • KMS tool has been detected

      • KMSAuto Net.exe (PID: 2284)
      • KMSAuto Net.exe (PID: 5304)
      • KMSAuto Net.exe (PID: 5304)

    • There is functionality for taking screenshot (YARA)

      • KMSAuto Net.exe (PID: 5304)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • The process executes VB scripts

      • KMSAuto Net.exe (PID: 5304)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Executable content was dropped or overwritten

      • KMSAuto Net.exe (PID: 5304)
      • wzt.dat (PID: 2332)
      • AESDecoder.exe (PID: 5988)
      • bin.dat (PID: 1272)
      • bin_x64.dat (PID: 3968)
      • wzt.dat (PID: 5172)
      • bin.dat (PID: 132)
      • AESDecoder.exe (PID: 4268)
      • bin_x64.dat (PID: 5728)
      • wzt.dat (PID: 6480)
      • bin.dat (PID: 5796)
      • AESDecoder.exe (PID: 5232)
      • bin_x64.dat (PID: 5328)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6712)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 4268)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 5216)
      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 2552)
      • cmd.exe (PID: 6944)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 5304)
      • cmd.exe (PID: 5968)
      • cmd.exe (PID: 1184)

    • Drops 7-zip archiver for unpacking

      • KMSAuto Net.exe (PID: 5304)

    • Adds/modifies Windows certificates

      • certmgr.exe (PID: 5780)
      • certmgr.exe (PID: 1168)
      • certmgr.exe (PID: 2092)
      • certmgr.exe (PID: 2852)
      • certmgr.exe (PID: 6960)
      • certmgr.exe (PID: 4348)

    • Process drops legitimate windows executable

      • wzt.dat (PID: 2332)
      • bin_x64.dat (PID: 3968)
      • wzt.dat (PID: 5172)
      • bin_x64.dat (PID: 5728)
      • wzt.dat (PID: 6480)
      • bin_x64.dat (PID: 5328)

    • Creates or modifies Windows services

      • KMSAuto Net.exe (PID: 5304)

    • Application launched itself

      • cmd.exe (PID: 5968)
      • cmd.exe (PID: 1184)

    • Creates a new Windows service

      • sc.exe (PID: 4844)
      • sc.exe (PID: 6904)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 5304)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 5304)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6036)
      • sc.exe (PID: 5332)
      • sc.exe (PID: 5796)
      • sc.exe (PID: 3304)
      • sc.exe (PID: 6268)
      • sc.exe (PID: 6592)

    • Executes as Windows Service

      • KMSSS.exe (PID: 7084)
      • KMSSS.exe (PID: 5780)

    • Uses ROUTE.EXE to modify routing table

      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 6080)

    • Drops a system driver (possible attempt to evade defenses)

      • bin_x64.dat (PID: 3968)
      • bin_x64.dat (PID: 5728)
      • bin_x64.dat (PID: 5328)

    • Uses REG/REGEDIT.EXE to modify registry

      • KMSAuto Net.exe (PID: 5304)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 4212)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 3024)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 5204)
      • cmd.exe (PID: 5360)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2288)
      • cmd.exe (PID: 6900)

    • Stops a currently running service

      • sc.exe (PID: 2096)
      • sc.exe (PID: 968)
      • sc.exe (PID: 3028)
      • sc.exe (PID: 644)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 1628)

    • Modifies existing scheduled task

      • schtasks.exe (PID: 6264)

  • INFO

    • Reads product name

      • KMSAuto Net.exe (PID: 5304)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 5304)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 4040)
      • BackgroundTransferHost.exe (PID: 1328)
      • BackgroundTransferHost.exe (PID: 5960)
      • BackgroundTransferHost.exe (PID: 6080)
      • BackgroundTransferHost.exe (PID: 5756)
      • BackgroundTransferHost.exe (PID: 4776)
      • cscript.exe (PID: 2980)
      • cscript.exe (PID: 2384)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 1328)
      • KMSAuto Net.exe (PID: 5304)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 1328)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 1328)

    • Creates a new folder

      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 5952)

    • Creates files in the program directory

      • KMSAuto Net.exe (PID: 5304)
      • cmd.exe (PID: 1012)
      • wzt.dat (PID: 2332)
      • bin.dat (PID: 1272)
      • AESDecoder.exe (PID: 5988)
      • bin_x64.dat (PID: 3968)
      • KMSSS.exe (PID: 7084)
      • wzt.dat (PID: 5172)
      • cmd.exe (PID: 3800)
      • bin.dat (PID: 132)
      • AESDecoder.exe (PID: 4268)
      • bin_x64.dat (PID: 5728)
      • wzt.dat (PID: 6480)
      • bin.dat (PID: 5796)
      • cmd.exe (PID: 5952)
      • bin_x64.dat (PID: 5328)
      • AESDecoder.exe (PID: 5232)
      • KMSSS.exe (PID: 5780)

    • Checks supported languages

      • wzt.dat (PID: 2332)
      • certmgr.exe (PID: 1168)
      • bin.dat (PID: 1272)
      • AESDecoder.exe (PID: 5988)
      • bin_x64.dat (PID: 3968)
      • certmgr.exe (PID: 5780)
      • KMSSS.exe (PID: 7084)
      • ShellExperienceHost.exe (PID: 3024)
      • FakeClient.exe (PID: 2984)
      • wzt.dat (PID: 5172)
      • certmgr.exe (PID: 2852)
      • certmgr.exe (PID: 2092)
      • AESDecoder.exe (PID: 4268)
      • bin.dat (PID: 132)
      • bin_x64.dat (PID: 5728)
      • wzt.dat (PID: 6480)
      • certmgr.exe (PID: 6960)
      • certmgr.exe (PID: 4348)
      • bin.dat (PID: 5796)
      • KMSSS.exe (PID: 5780)
      • AESDecoder.exe (PID: 5232)
      • bin_x64.dat (PID: 5328)
      • FakeClient.exe (PID: 3300)

    • The sample compiled with english language support

      • wzt.dat (PID: 2332)
      • AESDecoder.exe (PID: 5988)
      • KMSAuto Net.exe (PID: 5304)
      • bin_x64.dat (PID: 3968)
      • wzt.dat (PID: 5172)
      • AESDecoder.exe (PID: 4268)
      • bin_x64.dat (PID: 5728)
      • wzt.dat (PID: 6480)
      • bin_x64.dat (PID: 5328)
      • AESDecoder.exe (PID: 5232)

    • Reads the computer name

      • KMSSS.exe (PID: 7084)
      • FakeClient.exe (PID: 2984)
      • ShellExperienceHost.exe (PID: 3024)
      • KMSSS.exe (PID: 5780)
      • FakeClient.exe (PID: 3300)

    • Adds a route via ROUTE.EXE

      • ROUTE.EXE (PID: 5232)
      • ROUTE.EXE (PID: 7104)

    • Reads the machine GUID from the registry

      • KMSSS.exe (PID: 7084)
      • KMSSS.exe (PID: 5780)

    • Deletes a route via ROUTE.EXE

      • ROUTE.EXE (PID: 6108)
      • ROUTE.EXE (PID: 732)

    • Create files in a temporary directory

      • KMSAuto Net.exe (PID: 5304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (16)
.scr | Windows screen saver (7.6)
.dll | Win32 Dynamic Link Library (generic) (3.8)
.exe | Win32 Executable (generic) (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:11:12 13:50:41+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 8968704
InitializedDataSize: 49152
UninitializedDataSize: -
EntryPoint: 0x88f916
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.4.2.0
ProductVersionNumber: 1.4.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: MSFree Inc.
FileDescription: KMSAuto Net
FileVersion: 1.4.2
InternalName: KMSAuto Net.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: KMSAuto Net.exe
ProductName: KMSAuto Net
ProductVersion: 1.4.2
AssemblyVersion: 1.4.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
385
Monitored processes
234
Malicious processes
9
Suspicious processes
12

Behavior graph

Click at the process to see the details
start kmsauto net.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs cscript.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wzt.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs aesdecoder.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin_x64.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs slui.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs kmsss.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs fakeclient.exe no specs slui.exe no specs shellexperiencehost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs netsh.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wzt.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs aesdecoder.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin_x64.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wzt.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs aesdecoder.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin_x64.dat cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs kmsss.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs fakeclient.exe no specs sppextcomobj.exe reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs netsh.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs kmsauto net.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132C:\WINDOWS\Sysnative\cmd.exe /D /c del /F /Q "kmsauto.ini"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
132bin.dat -y -pkmsautoC:\ProgramData\KMSAutoS\bin.dat
cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Console SFX
Exit code:
0
Version:
15.09 beta
Modules
Images
c:\programdata\kmsautos\bin.dat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
208C:\WINDOWS\Sysnative\cmd.exe /D /c del /F /Q "bin_x64.dat"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
444reg.exe DELETE HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536C:\WINDOWS\Sysnative\cmd.exe /D /c del /F /Q "bin_x64.dat"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
616C:\WINDOWS\Sysnative\cmd.exe /D /c certmgr.exe -add wzt.cer -n wzt -s -r localMachine TRUSTEDPUBLISHERC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 345
Read events
15 296
Write events
35
Delete events
14

Modification events

(PID) Process:(4040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1328) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1328) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1328) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6080) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6080) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6080) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5960) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
50
Suspicious files
31
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\489f16cc-0562-4a35-8fcc-4d9648806e72.down_data —
MD5:—
SHA256:—
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\489f16cc-0562-4a35-8fcc-4d9648806e72.67eff38c-9c41-4d3d-8f19-fc3ad565d726.down_meta —
MD5:—
SHA256:—
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\901e0f11-ce72-46d2-af2b-6ed13f11b5f3.67eff38c-9c41-4d3d-8f19-fc3ad565d726.down_meta —
MD5:—
SHA256:—
5304KMSAuto Net.exeC:\Users\admin\AppData\Local\MSfree Inc\kmsauto.initext
MD5:B22721ECC7249380EF3032685ED19A5A
SHA256:2AC517A3388939951E5BC81489A251193C4BCB4620A9968BA0EC8F34594952D8
5304KMSAuto Net.exeC:\ProgramData\KMSAuto\wzt.datexecutable
MD5:B41540F62BDE758F2FBB8BD9372CC417
SHA256:21B5828E9B324690B1AF6352B44C4F668621EE659AB22D525D9AD175F652CB8C
5988AESDecoder.exeC:\ProgramData\KMSAuto\bin\TunMirror.exeexecutable
MD5:FB5F055633E4F7890004972E108A07CD
SHA256:02145C3F60E704DF17919CD26CB79BD31A12B98D66B0B7FD1CF7EA894AD1F871
2332wzt.datC:\ProgramData\KMSAuto\wzt\certmgr.exeexecutable
MD5:9D4F1124B2D870583268D19317D564AE
SHA256:EBAD2237B3E7CDF65385CCCE5099E82C7EC5080E737C97CE4E542CDBEA8D418D
5304KMSAuto Net.exeC:\ProgramData\KMSAuto\bin.datexecutable
MD5:BBCED89C77CA4BF6393CE721C9529DD1
SHA256:6FB83E1130EE71A0A0CF588CB34E335474FE4AF14CD67A7C845B707D7ADCB32D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1328
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6736
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5384
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5384
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6736
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6736
backgroundTaskHost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.4
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.128
  • 40.126.31.131
  • 40.126.31.0
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
www.bing.com
  • 104.126.37.176
  • 104.126.37.155
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.178
  • 104.126.37.161
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto Net.exe