How to remove KMSTools(1).exe

KMSTools(1).exe

The module KMSTools(1).exe has been detected as Hack.AutoKMS

KMSTools(1).exe
Remove KMSTools(1).exe

File Details

Product Name:

KMS Tools Portable
Company Name:

Ratiborus
MD5: 6c0a51be5b24fa10aaf0f478f55c9d24
Size: 17 MB
First Published: 2018-09-16 18:06:17 (7 years ago)
Latest Published: 2025-03-01 23:02:03 (8 months ago)
Status: Hack.AutoKMS (on last analysis)
Analysis Date: 2025-03-01 23:02:03 (8 months ago)

Overview

Signed By: WZTeam
Status: Valid

Common Places:

%sysdrive%\дрова\all activation windows (7-8-10) v10.5\all activation\kms
%sysdrive%\дрова\all activation windows (7-8-10) v10.5
%appdata%\zhp\quarantine
%sysdrive%\utilities\00\microsoft toolkit collection pack january 2017 [sadeempc]
%profile%\appdata\pictures\downloads\programs\msoffice2010
%profile%\appdata\pictures\downloads\programs\msoffice2010\msoffice2010pro32
%sysdrive%\проги
%desktop%
%sysdrive%\!! soft\microsoft office 2010
%sysdrive%\share folder\all activation windows 7-8-10 v10.5 + office activator [sadeempc]\all activation windows 7-8-10 v10.5 + office activator [sadeempc]\all activation\kms

File Names:

KMSTools.exe
KMSTools(1).exe
$RK6846C.exe

Geography:

14.5%
12.7%
10.9%
10.9%
10.9%
9.1%
5.5%
3.6%
3.6%
1.8%
1.8%
1.8%
1.8%
1.8%
1.8%
1.8%
1.8%
1.8%
1.8%

OS Version:

Windows 10 69.1%
Windows 7 25.5%
Windows XP 3.6%
Windows Server 2008 R2 1.8%

Analysis

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 32
Image Base: 0x00400000
Entry Address: 0x00001000

PE Sections:

Name Size of data MD5
.code 62976 c5fa309a44eec46711092875aab66ba6
.text 458752 017b9fc6d35c34a63b07aeeae803bcea
.rdata 105472 d1cb8e38140b57c1edaa71e4ea249f03
.data 17203200 661503483ff6db28a4aa80091c15935f
.rsrc 107520 99daa3c9fb6ac87affba70eadf6a8d6b

More information:

Search on Virustotal
Download GridinSoft Anti-Malware - Removal tool for KMSTools(1).exe
copyright for information about KMSTools(1).exe