KMSPico 11.1.2.exe
Classification: Malicious
KMSPico 11.1.2.exe is a trojan (Windows executable, 2.2 MB). Flagged by 57% of antivirus engines (72 detections).
Detection summary
- 72 antivirus detections (57% detection ratio)
- 0 IDS alerts
- 9 processes observed
- 27 contacted hosts
- 21 DNS requests
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Adware | Hybrid-Analysis | 2019-10-06 12:15:11 | 2019-10-06 12:15:11 |
Tags
bundlore evasiveSample information
- Filenames
- KMSPico 11.1.2.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 2333085 bytes
- MD5
21e28808fb7a1b01c7f92aa2bc730a23- SHA-1
bf2236e4809d18a0cff9d2807251456ae9317f66- SHA-256
66dd8d76236b196842133236427407cd93e6e5dd96b87db3df47959dd3e49bed- First indexed
- 2019-10-06 12:15:11
- Last updated
- 2025-12-26 03:24:38
Antivirus detections
| Engine | Detection |
|---|---|
| McAfee | Artemis!21E28808FB7A |
| Cylance | Unsafe |
| AegisLab | Trojan.Win32.Generic.4!c |
| K7AntiVirus | Adware ( 00557eb61 ) |
| K7GW | Adware ( 00557eb61 ) |
| Cybereason | malicious.4809d1 |
| Invincea | heuristic |
| F-Prot | W32/Adload.CI.gen!Eldorado |
| Symantec | Trojan.Gen.2 |
| ESET-NOD32 | a variant of Generik.HOOXKSF potentially unwanted |
| Paloalto | generic.ml |
| Kaspersky | Trojan-Dropper.Win32.Agent.bjysrz |
| NANO-Antivirus | Trojan.Win32.Generic.fzzlzt |
| Endgame | malicious (high confidence) |
| Comodo | ApplicUnwnt@#lpnyyb4gug7v |
| Zillya | Dropper.Agent.Win32.402937 |
| TrendMicro | TROJ_FRS.VSNW11I19 |
| McAfee-GW-Edition | BehavesLike.Win32.PUP.vc |
| Trapmine | malicious.high.ml.score |
| FireEye | Generic.mg.21e28808fb7a1b01 |
| Sophos | Generic PUA LP (PUA) |
| Cyren | W32/Adload.CI.gen!Eldorado |
| Fortinet | W32/Agent.BJYSRZ!tr |
| ZoneAlarm | Trojan-Dropper.Win32.Agent.bjysrz |
| Microsoft | Trojan:Win32/CryptInject.GTLM!MTB |
| AhnLab-V3 | Unwanted/Win32.KMSpico.C3472964 |
| VBA32 | TrojanDropper.Agent |
| Malwarebytes | Adware.Agent |
| Panda | Trj/CI.A |
| TrendMicro-HouseCall | TROJ_FRS.VSNW11I19 |
| Rising | [email protected] (RDMK:9hoVHLwmillFr7nIZwBb7g) |
| SentinelOne | DFI - Suspicious PE |
| MaxSecure | Trojan.Malware.74560438.susgen |
| GData | Win32.Adware.Prepscram.6API50 |
| Webroot | W32.Hacktool.Kms |
| AVG | Win32:Adware-gen [Adw] |
| Avast | Win32:Adware-gen [Adw] |
| CrowdStrike | win/malicious_confidence_80% (D) |
| Qihoo-360 | HEUR/QVM07.1.EC87.Malware.Gen |
| ALYac | Gen:Variant.Doina.18541 |
| AhnLab-V3 | Malware/Win32.RL_Generic.R325223 |
| Alibaba | TrojanDropper:Win32/CryptInject.4da741bc |
| Arcabit | Trojan.Doina.D486D |
| Avira | TR/Injector.lsdbn |
| BitDefender | Gen:Variant.Doina.18541 |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Ghanarava.1744016677730a23 |
| CTX | exe.trojan.cryptinject |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Doina.18541 (B) |
| F-Secure | Trojan.TR/Injector.lsdbn |
| GData | Gen:Variant.Doina.18541 |
| Detected | |
| Lionic | Trojan.Win32.CryptInject.b!c |
| Malwarebytes | Generic.Malware/Suspicious |
| McAfeeD | ti!66DD8D76236B |
| MicroWorld-eScan | Gen:Variant.Doina.18541 |
| Microsoft | Trojan:Win32/CryptInject.GTLM!rfn |
| Sangfor | Dropper.Win32.CryptInject.V7gw |
| Skyhigh | Artemis!Trojan |
| Sophos | Mal/Generic-S |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.143d24f7 |
| TrellixENS | Artemis!21E28808FB7A |
| VIPRE | Gen:Variant.Doina.18541 |
| Varist | W32/Adload.CI.gen!Eldorado |
| Xcitium | ApplicUnwnt@#lpnyyb4gug7v |
| Yandex | Trojan.DR.Agent!nJsTzxpd0UY |
| alibabacloud | Trojan[dropper]:Win/CryptInject.GSAP3tVR |
Network contacts
99.84.170.3 185.66.120.52 172.217.8.202 78.140.188.190 99.84.170.222 172.217.9.68 172.217.4.46 216.58.192.163 172.217.4.200 172.217.0.3 23.45.134.90 172.217.8.163 78.140.188.189 151.101.2.110 162.247.242.21 104.18.43.144 172.217.9.34 13.58.173.167 216.58.192.194 13.249.94.119 99.84.240.4 99.84.170.55 99.84.170.61 13.249.94.29 99.84.170.27 178.237.33.51 78.140.188.188
DNS requests
bam.nr-data.net crl.rootca1.amazontrust.com crl.sca1b.amazontrust.com d1hq9wbcfo7dcl.cloudfront.net d3ud741uvs727m.cloudfront.net destyy.com filemedia.net js-agent.newrelic.com noriskdomain.com o.ss2.us ocsp.pki.goog ocsp.rootca1.amazontrust.com ocsp.rootg2.amazontrust.com ocsp.sca1b.amazontrust.com pagead2.googlesyndication.com shorte.st ssl.geoplugin.net static.sh.st static.shorte.st wurfl.io www.gstatic.com
Process list
| Name | Command line |
|---|---|
| KMSPico11.1.2.exe | |
| cmd.exe | /c ""%PROGRAMFILES%\KMSPico 10.2.1 Final\KMSPicoSetup.bat"" |
| KMSPico.exe | |
| schtasks.exe | schtasks /create /tn "SVC Update" /tr "%WINDIR%\explorer.exe ""http://destyy.com/w2ktxr""" /sc DAILY |
| iexplore.exe | https://filemedia.net/41725/kmsupdate |
| iexplore.exe | SCODEF:2612 CREDAT:275457 /prefetch:2 |
| cmd.exe | /c ""%TEMP%\deldll.bat" " |
| PING.EXE | ping -n 2 -w 1000 127.0.0.1 |
| explorer.exe | ""http://destyy.com/w2ktxr"" |