How to remove fakeclient.exe
- File Details
- Overview
- Analysis
fakeclient.exe
The module fakeclient.exe has been detected as Hack.KMS
File Details
| MD5: |
515767bdda337f0251a26d47cc7f80ec |
| Size: |
11 KB |
| First Published: |
2017-09-11 18:07:01 (7 years ago) |
| Latest Published: |
2023-06-21 23:10:28 (2 years ago) |
| Status: |
Hack.KMS (on last analysis) |
|
| Analysis Date: |
2023-06-21 23:10:28 (2 years ago) |
Overview
| Signed By: |
WZT |
| Status: |
Invalid (digital signature could be stolen or file could be patched) |
| %windir%\files\bin\x86wdv |
| %sysdrive%\$recycle.bin\s-1-5-21-3587992563-859264662-1537172197-1001\$rvdfzef\online\files\bin\x86wdv |
| %sysdrive%\softwares\microsoft office professional plus 2016 + activation tool [danhuk]\disc image\files\bin |
| %windir%\files\bin |
| %sysdrive%\microsoft toolkit collection pack february 2017\kms tools portable 21.02.17 (fungerar)\kms tools portable\programs\office 2013-2016 c2r install v5.9.2\files\bin |
| %sysdrive%\backup verbatim usb 2018-04-18\microsoft toolkit collection pack february 2017\kms tools portable 21.02.17 (fungerar)\kms tools portable\programs\office 2013-2016 c2r install v5.9.2\files\bin |
| %desktop%\aktivator!!!\kms tools portable 06_08_2016_\programs\pidkey v2.1.2.1015\kms tools portable 06_08_2016_\programs\office 2013-2016 c2r install v5.8.1\files\bin |
| %desktop%\aktivator!!!\kms tools portable 06_08_2016_\programs\office 2013-2016 c2r install v5.8.1\files\bin |
| %desktop%\kms.tools.portable.12.01.2017\kmstools\programs\office 2013-2016 c2r install v5.9.2\files\bin |
| %profile%\downloads\vuze+\office 2019 en\files\bin |
| FakeClient.exe |
| fakeclient.exe |
|
14.0% |
|
|
9.3% |
|
|
7.0% |
|
|
4.7% |
|
|
4.7% |
|
|
4.7% |
|
|
4.7% |
|
|
4.7% |
|
|
4.7% |
|
|
4.7% |
|
|
4.7% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
|
2.3% |
|
| Windows 10 |
93.3% |
|
| Windows 7 |
4.4% |
|
| Windows 8.1 |
2.2% |
|
Analysis
| Subsystem: |
Windows CUI |
| PE Type: |
pe |
| OS Bitness: |
32 |
| Image Base: |
0x00400000 |
| Entry Address: |
0x00001290 |
| Name |
Size of data |
MD5 |
| .text |
3072 |
583a5877eb4386002511abf305be3be4 |
| .rdata |
2560 |
b549b0ff25742855f0f8145eb7bc2943 |
| .data |
512 |
26d2af9b5ae35538e55951b8e598e42b |
| .rsrc |
512 |
5b173046da08848d8fcc1b207e8c49ca |
| .reloc |
512 |
11700ab6c5c60b4e04b6d1c30c60d283 |
