File name:

KMS_Suite.v9.5.EN.bat

Full analysis: https://app.any.run/tasks/ab947723-5533-4418-98f9-8b36f6a4ff53
Verdict: Malicious activity
Analysis date: July 10, 2024, 16:54:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

AF73BF925361348072469CFF78890A4B

SHA1:

DCA20E41242D9398F474BABB80C971E5FC27DE69

SHA256:

CC331C94FD9E4584F405BD6B03FB99ECFBB5293017293FC0A37A9B1737D31722

SSDEEP:

6144:zaGyPc7/Tg7jc4zlw6PhVMt1pOb4RKsFx+GXtO9l0X0dgJ/pGntI/:zaXEDTg84z5pVM9O0lgz70kd0pEE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • csc.exe (PID: 5268)
      • expand.exe (PID: 6324)
      • csc.exe (PID: 5988)
      • csc.exe (PID: 3760)
      • csc.exe (PID: 5252)

    • Changes powershell execution policy (RemoteSigned)

      • cmd.exe (PID: 992)

  • SUSPICIOUS

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6220)
      • cmd.exe (PID: 6408)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6220)
      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 992)

    • Application launched itself

      • cmd.exe (PID: 6220)
      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 992)

    • Executing commands from a ".bat" file

      • cmd.exe (PID: 6220)
      • cmd.exe (PID: 6408)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 992)
      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 1832)
      • cmd.exe (PID: 6256)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 992)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 992)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 992)
      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 6256)
      • cmd.exe (PID: 1832)

    • Unpacks CAB file

      • expand.exe (PID: 6324)
      • expand.exe (PID: 6520)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 5268)
      • expand.exe (PID: 6324)
      • xcopy.exe (PID: 2632)
      • csc.exe (PID: 5988)
      • csc.exe (PID: 3760)
      • csc.exe (PID: 5252)

    • Process drops legitimate windows executable

      • xcopy.exe (PID: 2632)
      • expand.exe (PID: 6324)

    • The process executes Powershell scripts

      • cmd.exe (PID: 992)

    • The executable file from the user directory is run by the CMD process

      • center.exe (PID: 3156)
      • center.exe (PID: 2448)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 992)

    • The process executes VB scripts

      • cmd.exe (PID: 992)

    • The process hides Powershell's copyright startup banner

      • cmd.exe (PID: 992)

    • Potential TCP-based PowerShell reverse shell connection

      • cmd.exe (PID: 992)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 992)

  • INFO

    • Checks supported languages

      • mode.com (PID: 6280)
      • mode.com (PID: 6484)
      • csc.exe (PID: 5268)
      • cvtres.exe (PID: 6316)
      • expand.exe (PID: 6324)
      • mode.com (PID: 3560)
      • csc.exe (PID: 5988)
      • cvtres.exe (PID: 6256)
      • mode.com (PID: 6448)
      • center.exe (PID: 3156)
      • mode.com (PID: 752)
      • mode.com (PID: 4048)
      • csc.exe (PID: 5252)
      • expand.exe (PID: 6520)
      • cvtres.exe (PID: 3108)
      • csc.exe (PID: 3760)
      • cvtres.exe (PID: 4084)
      • center.exe (PID: 2448)
      • mode.com (PID: 6584)
      • mode.com (PID: 8)
      • mode.com (PID: 7032)
      • mode.com (PID: 2992)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 5268)
      • expand.exe (PID: 6324)
      • csc.exe (PID: 5988)
      • csc.exe (PID: 5252)
      • expand.exe (PID: 6520)
      • csc.exe (PID: 3760)

    • Create files in a temporary directory

      • cvtres.exe (PID: 6316)
      • csc.exe (PID: 5268)
      • expand.exe (PID: 6324)
      • xcopy.exe (PID: 2632)
      • csc.exe (PID: 5988)
      • cvtres.exe (PID: 6256)
      • expand.exe (PID: 6520)
      • csc.exe (PID: 5252)
      • cvtres.exe (PID: 3108)
      • csc.exe (PID: 3760)
      • cvtres.exe (PID: 4084)

    • Drops the executable file immediately after the start

      • xcopy.exe (PID: 2632)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5244)

    • Checks operating system version

      • cmd.exe (PID: 992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
232
Monitored processes
92
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs mode.com no specs reg.exe no specs fltmc.exe no specs cmd.exe conhost.exe no specs mode.com no specs reg.exe no specs fltmc.exe no specs reg.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs expand.exe xcopy.exe cmd.exe no specs mode.com no specs powershell.exe no specs csc.exe cvtres.exe no specs mode.com no specs powershell.exe no specs cmd.exe no specs mode.com no specs center.exe no specs cmd.exe no specs powershell.exe no specs sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs powershell.exe no specs mode.com no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs choice.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs expand.exe no specs wscript.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs mode.com no specs powershell.exe no specs cmd.exe no specs mode.com no specs center.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs mode.com no specs cmd.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs findstr.exe no specs choice.exe no specs mode.com no specs cmd.exe no specs choice.exe no specs wscript.exe no specs reg.exe no specs find.exe no specs wmic.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs powershell.exe no specs powershell.exe no specs findstr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8mode con cols=92 lines=35C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\ureg.dll
c:\windows\system32\ulib.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
696C:\WINDOWS\system32\cmd.exe /c time /tC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
752mode con cols=92 lines=35C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\ureg.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
992cmd.exe /c KMS_Suite.bat -suiteC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1048Powershell.exe -executionpolicy remotesigned -File disablex.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1048choice /C:123456 /N /M "YOUR CHOICE :"C:\Windows\System32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
4
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1116findstr /v /a:78 /R "^f7f81a39-5f63-5b42-9efd-1f13b5431005quot; " KMS & KMS 2038 & Digital & Online Activation Suite v9.5 - mephistooo2 - www.TNCTR.com" nul C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1272"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\27875\bin\check.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348choice /C:123456 /N /M "YOUR CHOICE :"C:\Windows\System32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1384C:\WINDOWS\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
68 854
Read events
68 814
Write events
36
Delete events
4

Modification events

(PID) Process:(6220) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6220) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6220) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6220) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6220) cmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\system32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(6220) cmd.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\system32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(6556) reg.exeKey:HKEY_CLASSES_ROOT\.Admin\shell\runas\command
Operation:delete keyName:(default)
Value:
(PID) Process:(6556) reg.exeKey:HKEY_CLASSES_ROOT\.Admin\shell\runas
Operation:delete keyName:(default)
Value:
(PID) Process:(6556) reg.exeKey:HKEY_CLASSES_ROOT\.Admin\shell
Operation:delete keyName:(default)
Value:
(PID) Process:(6556) reg.exeKey:HKEY_CLASSES_ROOT\.Admin
Operation:delete keyName:(default)
Value:
Executable files
28
Suspicious files
10
Text files
81
Unknown types
1

Dropped files

PID
Process
Filename
Type
5268csc.exeC:\Users\admin\AppData\Local\Temp\orrnp5af\orrnp5af.dllexecutable
MD5:C0E4A9325B41E64BBD3E8437AED417E7
SHA256:62C65C9AA46A9A97489526E058F6A6AAEAEDD61DBED4DDE0C83C1E9F459C9D1B
6316cvtres.exeC:\Users\admin\AppData\Local\Temp\RESF94C.tmpbinary
MD5:1B02C2681652122B8C37C5992F2771EC
SHA256:4044BB2B03CD719F4066FB292515408EE53F00954EF99936352898BCB3AE9DAA
6576powershell.exeC:\Users\admin\AppData\Local\Temp\orrnp5af\orrnp5af.cmdlinetext
MD5:AF191CB5F32C1D8F0656A57CD273F7D1
SHA256:683F09C04C3F5C2983A39E5EACBCD89D7834682DFC001F43DF19CC87325098A0
6576powershell.exeC:\Users\admin\AppData\Local\Temp\orrnp5af\orrnp5af.0.cstext
MD5:047F0CF592670E8FCA358F12E4CD5A89
SHA256:32E77D9085AD9EA0FD1EB5A9556E29CB42F5D3016CCF9853F3C39D358F479978
5268csc.exeC:\Users\admin\AppData\Local\Temp\orrnp5af\CSC7D40C50F3AD441059014512A13276EB.TMPbinary
MD5:58099E17F9EAD7893B59B10C108ADB05
SHA256:7D7B82E7E004C55C115DA09CC9A1DB2C2223E3CB56BE1927EC732A1E93BEE5E8
6576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rojs0kap.pi3.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6576powershell.exeC:\Users\admin\AppData\Local\Temp\1compressed
MD5:2B6D8E1E450072798B678F8F6A8D623F
SHA256:0297EDF9BFC2D0C9E0C479185812A95258CEC5D3A04262F5BA7B89990B32C847
6324expand.exeC:\Users\admin\AppData\Local\Temp\KMS_Suite\bin\disableX.ps1text
MD5:522C0E01B280581A62954CF1E7971EAA
SHA256:2D2E271131E130688218B369CADA1444807A0A65120DF942A98E7887BDFE7201
6324expand.exeC:\Users\admin\AppData\Local\Temp\KMS_Suite\bin\Digital\bin\slc.dllexecutable
MD5:F18DD5B638590BE87CCD56FE338BED10
SHA256:E7ECA8C7476DF70EF525AE55A0D8CCC715F22A727165A05FD4C380032CF763A9
6324expand.exeC:\Users\admin\AppData\Local\Temp\KMS_Suite\bin\Digital\bin\gatherosstate.exeexecutable
MD5:15CE0753A16DD4F9B9F0F9926DD37C4E
SHA256:028C8FBE58F14753B946475DE9F09A9C7A05FD62E81A1339614C9E138FC2A21D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
61
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6116
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
6068
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
6840
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6116
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6280
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6280
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6116
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1272
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4752
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4656
SearchApp.exe
2.23.209.189:443
www.bing.com
Akamai International B.V.
GB
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6068
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6068
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.23.209.189
  • 2.23.209.135
  • 2.23.209.150
  • 2.23.209.148
  • 2.23.209.144
  • 2.23.209.193
  • 2.23.209.130
  • 2.23.209.141
  • 2.23.209.149
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 172.217.18.14
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.72
  • 20.190.160.20
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMS_Suite.v9.5.EN.bat