![ESET Research on X: "In November 2021, #ESETresearch saw how #Lazarus attackers installed one of their payloads into C:\ProgramData\KMSAutoS\KMSAuto.bin and, thus, disguised it as a well-known Windows activation tool. By this camouflage ESET Research on X: "In November 2021, #ESETresearch saw how #Lazarus attackers installed one of their payloads into C:\ProgramData\KMSAutoS\KMSAuto.bin and, thus, disguised it as a well-known Windows activation tool. By this camouflage](https://pbs.twimg.com/media/FS4W3znWIAECgir.png)
ESET Research on X: "In November 2021, #ESETresearch saw how #Lazarus attackers installed one of their payloads into C:\ProgramData\KMSAutoS\KMSAuto.bin and, thus, disguised it as a well-known Windows activation tool. By this camouflage
![Malware analysis https://kms-auto.site/wp-content/uploads/2018/12/KMS-Tools.zip Suspicious activity | ANY.RUN - Malware Sandbox Online Malware analysis https://kms-auto.site/wp-content/uploads/2018/12/KMS-Tools.zip Suspicious activity | ANY.RUN - Malware Sandbox Online](https://content.any.run/tasks/f8d05f8b-f954-48bc-be58-9b1c195d0052/download/screens/3899a8d9-d70c-4fde-a48a-2367a5d67bf6/image.jpeg)
Malware analysis https://kms-auto.site/wp-content/uploads/2018/12/KMS-Tools.zip Suspicious activity | ANY.RUN - Malware Sandbox Online
![Unable to activate office, I have tried KMS auto net, KMS all and MAS. They all stuck (see image) and doest do anything. I opened it as Admin. Download office from site Unable to activate office, I have tried KMS auto net, KMS all and MAS. They all stuck (see image) and doest do anything. I opened it as Admin. Download office from site](https://i.redd.it/qhq989phfxk71.jpg)