RiskTool.Win32.HackKMS.d (file analysis)

The RiskTool.Win32.HackKMS.d is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What RiskTool.Win32.HackKMS.d virus can do?

Reads data out of its own binary image
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Anomalous binary characteristics

How to determine RiskTool.Win32.HackKMS.d?


File Info:
crc32: F5A59802
md5: 7a22e112625f4d76aa26147bd4fa90de
name: 7A22E112625F4D76AA26147BD4FA90DE.mlw
sha1: e43078887bc8d4ff2102caaea0d486d79f1fa7b2
sha256: 84101dc554af8b4c58c85067a00be27867478c293a302956d876d2ada6044178
sha512: 19c0e929f662decdb08df879bca81ee943f39b096757f74059ef18261e6a07c5ec42bc8a73d6f899bc119e3ccc633500268fd702aeb8f0537e0916f4af69a96b
ssdeep: 49152:lFQWKKEP2biE2JjaKpphphtxw/8SK7icMxDdgWbO:lFLEP2b2JVdphgESK7icMJ6WbO
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: @Copyright By Zbezj
CompanyName: HEU CNST
FileVersion: 7.6.0.0
FileDescription: HEU KMS Activator
Translation: 0x0804 0x04b0

RiskTool.Win32.HackKMS.d also known as:

Bkav	W32.AIDetectVM.malware1
K7AntiVirus	Unwanted-Program ( 004d38111 )
Cynet	Malicious (score: 100)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	HackTool:Win32/KMSAuto.1ad77327
K7GW	Unwanted-Program ( 004d38111 )
Cybereason	malicious.87bc8d
ESET-NOD32	Win32/HackKMS.AV potentially unsafe
APEX	Malicious
ClamAV	Win.Malware.Autoit-6753917-0
Kaspersky	not-a-virus:RiskTool.Win32.HackKMS.d
Sophos	Generic PUA OE (PUA)
VIPRE	HackTool.Win32.Keygen
McAfee-GW-Edition	BehavesLike.Win32.PUP.tc
FireEye	Generic.mg.7a22e112625f4d76
Jiangmin	RiskTool.HackKMS.j
Webroot	W32.Malware.Heur
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	HackTool:Win32/Keygen
AegisLab	Riskware.Win32.HackKMS.1!c
ZoneAlarm	not-a-virus:RiskTool.Win32.HackKMS.d
GData	Win32.Trojan.Agent.UW66R9
AhnLab-V3	Unwanted/Win32.KMSActivator.R202307
McAfee	Artemis!7A22E112625F
Malwarebytes	RiskWare.KMS
TrendMicro-HouseCall	TROJ_GEN.R014H0CJ620
Rising	Trojan.Win32.Malware.bmv (CLASSIC)
Fortinet	Riskware/HackKMS

How to remove RiskTool.Win32.HackKMS.d?

RiskTool.Win32.HackKMS.d removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X