Our call: Is OInstall_x64.exe safe?Malicious
Unsigned 17 MB executable flagged by 12 tier-1 engines as AutoKMS hacktool with process-injection and LSASS access observed.
- 7 high-confidence signature or behavior rules matched this file.Derived · Signature and behavior rules
- 56 of 74 antivirus engines flagged the file, including AhnLab-V3 and Alibaba.Observed · Antivirus analysis
- The hash has a long, established submission history across 2,933 sources.Derived · Submission history
a72a7e24885c82b720…42f8cd24f8Recommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete56 of 74 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial20 runtime contacts were observed without a completed reputation cross-check.
YARA
Complete8 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
OInstall_x64.exe
a72a7e24885c82b720e7d33e496370ab4b4a1d1e43fc45a97dbf4642f8cd24f8
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\executable.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\<USER>\Desktop\executable.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
files.dat
C:\Users\<USER>\Desktop\files\files.dat
04Isolated runtime analysis - Written fileObserved
Configure.xml
C:\Users\<USER>\Desktop\files\Configure.xml
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
52.109.120.46
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
52.110.15.72
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
7 high-confidence signature or behavior rules matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
56 of 74 antivirus engines flagged the file, including AhnLab-V3 and Alibaba.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has a long, established submission history across 2,933 sources.
ProvenanceDerivedSourceSubmission historyObserved at - 04
Scanned file: OInstall_x64.exe — a72a7e24885c82b720e7d33e496370ab4b4a1d1e43fc45a97dbf4642f8cd24f8
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\executable.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\<USER>\Desktop\executable.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: files.dat — C:\Users\<USER>\Desktop\files\files.dat
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: Configure.xml — C:\Users\<USER>\Desktop\files\Configure.xml
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: 52.109.120.46 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: 52.110.15.72 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
56 of 74 engines detect the file, including 12 tier-1 engines that label it a KMS-activation hacktool. Sandbox evidence shows process injection, PowerShell execution, LSASS access and direct-IP traffic; the binary is unsigned.
The combination of tier-1 consensus on the AutoKMS family, confirmed hacktool labels, and offensive MITRE techniques (T1055, T1059.001, T1134, T1485) outweighs the common_old prevalence. Absence of code signing and the presence of 17 YARAify rules further support the malicious classification. No contradictory clean signals from trusted publishers or prior similar-hash verdicts exist.
What We Detected
12 tier-1 engines (Microsoft, Kaspersky, ESET-NOD32, BitDefender, Avast, etc.) flag the sample as HackTool/AutoKMS variants. 17 YARA rules fired and high-severity heuristics detected process injection and LSASS credential-dumping behaviour.
Threat Behavior
The executable writes multiple dropped files, spawns PowerShell downloaders, adds Windows Defender exclusions via WMIC, and contacts 17 raw IP addresses. Observed MITRE techniques include T1055 (process injection), T1059.001 (PowerShell), T1134 (token manipulation) and T1485 (data destruction).
What To Do Now
Do not execute the file. Keep endpoint protection enabled and remove any copies. If already run, scan the system for persistence mechanisms and review recently added Defender exclusions.
Where this verdict could be wrong3 caveats
- prevalence.classification=common_old (2933 submitters) could indicate a widely distributed utility rather than targeted malware.
- contactedHosts=null means no completed host-reputation cross-check; direct-IP traffic alone is not conclusive.
- droppedChildren.hasMaliciousChild=false and no sandbox malicious verdict recorded.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- droppedChildren.hasMaliciousChild=false
- common_old prevalence (2933 submitters)
- 12 tier-1 malicious detections
- hacktoolConfirmed flag active
- offensive MITRE techniques observed
- LSASS access and process injection
- unsigned executable
- YARAify 17-rule match
Treat the file as malicious; block or delete it and investigate any systems where it has already executed.
Behavior
Plain-English impact first, then the observed runtime evidence.
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Used an input-capture technique that can record credentials or keystrokes.
High concern: Used removable-media replication behaviour that can spread files between devices.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Removed execution artefacts or logs, which can conceal activity.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How hacktools are abused
This is a hacking or cracking tool — the kind used to bypass software licences, generate fake keys, or attack other systems. Even when the tool 'works', these downloads very often carry hidden malware.
Bottom line:Running one means trusting an anonymous author with full access to your PC — rarely worth the risk.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 52.109.120.46
- 52.110.15.72
- 52.110.15.87
- 52.110.20.35
- 1.1.1.1
- 52.109.0.138
- 20.99.186.246
- 23.192.210.9
- 23.198.171.50
- 20.99.185.48
- C:\Users\<USER>\Desktop\files\files.dat
- C:\Users\<USER>\Desktop\files\Configure.xml
- C:\Users\<USER>\Desktop\files\x64
- C:\Users\<USER>\Desktop\files\x86
- C:\Users\<USER>\Desktop\files\Uninstall.xml
- C:\Users\<USER>\AppData\Local\Temp\oinstall_download.log
- C:\Users\<USER>\AppData\Local\Temp\oinstall_aria2_log1.log
- C:\Users\<USER>\AppData\Local\Temp\oinstall_aria2_log2.log
- C:\Users\<USER>\Desktop\files\files.dat
- C:\Users\<USER>\Desktop\files\Configure.xml
- \Sessions\1\BaseNamedObjects\DirectSound Administrator shared thread array (lock
- \Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00000AAC)
- \Sessions\1\BaseNamedObjects\Global\RasPbFile
- \Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001864)
- \Sessions\1\BaseNamedObjects\DirectSound Administrator shared thread array (lock)
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 0ae98794b3523634b0af…4d2a66Never scannednever seen before
- 4e3b13b56bec0e41778e…b44c8eNever scannednever seen before
- 96ad1146eb96877eab59…87dcf7Never scannednever seen before
- 04ba4487f95290e0b055…539f25Never scannednever seen before
- edf85f4e2ef1a427b342…c8522aNever scannednever seen before
- 1d1a1ae540ba132f998d…560a36Never scannednever seen before
- b3616b9fc3f6c0b4a5bd…611e4fNever scannednever seen before
- 8d1db5d95d05329c00c6…f4df9cNever scannednever seen before
- 60c06e0fa4449314da3a…862efaNever scannednever seen before
- a187c22082711edd98c2…d22fffNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Detection sources at a glance
Category: hacktool
One or more independent reference databases matched this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
- BLOWFISH_Constants
- DebuggerCheck__API
- DebuggerException__SetConsoleCtrl
- Detect_Malicious_VBScript_Base64
- Detect_PowerShell_Obfuscation
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceKaspersky: HackTool.Win32.KMSAuto.grpThe sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence52.109.120.46 · 52.110.15.72 · 52.110.15.87
56 of 74 engines flagged this file
View all 74 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Fingerprint and provenance
- File name
- OInstall_x64.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 17.1 MB
- Last analyzed
- Jul 28, 2026, 2:33 AM UTC
a72a7e24885c82b720e7d33e496370ab4b4a1d1e43fc45a97dbf4642f8cd24f8Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
From a different, clean device, change the passwords on your important accounts (email and banking first) and turn on two-factor authentication.
Get a fresh copy from the developer's official site or an official app store.