Is KMSAuto___1.9.9_b06.zip safe?
KMSAuto activator archive flagged by 9 tier-1 engines and confirmed as hacktool by multiple vendors.
35 of 77 engines detect this ZIP as KMSAuto hacktool with 9 tier-1 detections. Sandbox shows process injection, service creation, and data-wiping techniques typical of KMS activators.
07990db0da41a889cf…2b0f87804f17caRecommended next actions
Before opening or extracting
Do not open or extract it. Delete this archive from the device, then empty the Recycle Bin or Trash.
If you already opened or extracted it
Close it. If it opened links, requested credentials, or triggered unexpected behavior, disconnect from the internet and run a full device scan.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
35 of 77 engines detect this ZIP as KMSAuto hacktool with 9 tier-1 detections. Sandbox shows process injection, service creation, and data-wiping techniques typical of KMS activators.
The file exhibits clear hacktool characteristics: 9 tier-1 engines label it KMSAuto, hacktoolConfirmed is true, and sandbox logs reveal MITRE techniques used exclusively by offensive tooling. No code-signing applies, prevalence is only medium, and no clean RAG history counters the engine consensus. The absence of a completed host-reputation check is noted but does not outweigh the detection volume.
What We Detected
35 of 77 engines flagged the archive; 9 tier-1 engines returned KMSAuto or HackKMS labels. Sandbox execution revealed six offensive MITRE techniques including T1055 process injection and T1543.003 service creation.
Threat Behavior
KMSAuto tools attempt to activate unlicensed Windows/Office copies by patching system components and disabling security features. Observed actions match known KMSAuto patterns: dropping executables, querying Defender registry keys, and creating persistence mechanisms.
What To Do Now
Do not execute or distribute this file. Delete the archive and any extracted binaries. Keep endpoint protection enabled; KMS activators frequently bundle additional malware.
Where this verdict could be wrong1 caveat
- contactedHosts=null — host-reputation cross-check not completed; cannot assert clean network behaviour.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Multiple tier-1 hacktool detections
- Offensive MITRE techniques observed in sandbox
- Filename and branding match known KMSAuto tooling
Treat as malicious; remove the file and avoid any KMS-activation software.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete35 of 77 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 29MITRE ATT&CK techniques
- 15spawned processes
- 0network contacts
- 22filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Used an input-capture technique that can record credentials or keystrokes.
High concern: Used removable-media replication behaviour that can spread files between devices.
High concern: Created or modified a system service, which can keep code running.
High concern: Attempted to impair or bypass security controls.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Runs hidden system commands (script or shell).
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How hacktools are abused
This is a hacking or cracking tool — the kind used to bypass software licences, generate fake keys, or attack other systems. Even when the tool 'works', these downloads very often carry hidden malware.
Bottom line:Running one means trusting an anonymous author with full access to your PC — rarely worth the risk.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
KMSAuto___1.9.9_b06.zip
07990db0da41a889cf0104b2e48034bd8197e736225dcb67fc2b0f87804f17ca
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\Setup/KMSAuto x64.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\<USER>\AppData\Local\Temp\KMSAuto.tmp" /Y
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
KMSAutoLite.ini
C:\Users\<USER>\AppData\Local\Temp\Setup\KMSAutoLite.ini
04Isolated runtime analysis - Written fileObserved
KMSAuto++.ini
C:\Users\<USER>\AppData\Local\Temp\Setup\KMSAuto++.ini
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\Setup\KMSAutoLite.ini
- C:\Users\<USER>\AppData\Local\Temp\Setup\KMSAuto++.ini
- C:\Users\<USER>\AppData\Local\Temp\Setup\OInstallLite.exe
- C:\Users\<USER>\AppData\Local\Temp\Setup\files\Configure.xml
- C:\Users\<USER>\AppData\Local\Temp\Setup\files\files.dat
- C:\Users\<USER>\AppData\Local\Temp\oinstall_download.log
- C:\Users\<USER>\AppData\Local\Temp\oinstall_aria2_log1.log
- C:\Users\<USER>\AppData\Local\Temp\oinstall_aria2_log2.log
- C:\Users\<USER>\AppData\Local\Temp\Setup\files\files.dat
- C:\Users\<USER>\AppData\Local\Temp\Setup\files\Configure.xml
- \Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- c7a2d7fa7dcf9a08a517…23c939Never scannednever seen before
- 96ad1146eb96877eab59…87dcf7Never scannednever seen before
- 46a797caf1af3401f750…51f79dNever scannednever seen before
- 04ba4487f95290e0b055…539f25Never scannednever seen before
- 6785ec0d7d578777e460…14131fNever scannednever seen before
- 1ea0664aec5eb210a11c…41f531Never scannednever seen before
- 8497aa029bd04a8ab23e…716a87Never scannednever seen before
- 63fd0dc7794ad6138896…17d8d8Never scannednever seen before
- 9778ef93c59ca1e6e86f…6f6567Never scannednever seen before
- edf85f4e2ef1a427b342…c8522aNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 35 / 77engines flagged
- 6sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
35 of 77 antivirus engines flagged the file, including alibabacloud and ALYac.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has been submitted 6 times from 6 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: KMSAuto___1.9.9_b06.zip — 07990db0da41a889cf0104b2e48034bd8197e736225dcb67fc2b0f87804f17ca
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\AppData\Local\Temp\Setup/KMSAuto x64.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\<USER>\AppData\Local\Temp\KMSAuto.tmp" /Y
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: KMSAutoLite.ini — C:\Users\<USER>\AppData\Local\Temp\Setup\KMSAutoLite.ini
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: KMSAuto++.ini — C:\Users\<USER>\AppData\Local\Temp\Setup\KMSAuto++.ini
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: hacktool
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Users\<USER>\AppData\Local\Temp\Setup/KMSAuto x64.exe"
35 of 77 engines flagged this file
View all 77 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- KMSAuto___1.9.9_b06.zip
- Format
- ZIP
- Code signing
- Not applicable to this file type
- Size
- 39.3 MB
- Last analyzed
- Aug 24, 2026, 7:05 PM UTC
07990db0da41a889cf0104b2e48034bd8197e736225dcb67fc2b0f87804f17caSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't open or extract this archive. Delete this archive from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already opened or extracted it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
From a different, clean device, change the passwords on your important accounts (email and banking first) and turn on two-factor authentication.
- Recovery step 04
Get a fresh copy from the original trusted source and verify its exact hash when possible.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is KMSAuto___1.9.9_b06.zip a virus?
What is KMSAuto___1.9.9_b06.zip?
How many antivirus engines detected KMSAuto___1.9.9_b06.zip?
What should I do if I already opened or extracted KMSAuto___1.9.9_b06.zip?
How do I remove KMSAuto___1.9.9_b06.zip?
What kind of malware is KMSAuto___1.9.9_b06.zip?
What is the SHA-256 hash of KMSAuto___1.9.9_b06.zip?
How up to date is this analysis of KMSAuto___1.9.9_b06.zip?
Community
Member reviews and reports for this exact file hash.