File name:

WACT_AIO.bat

Full analysis: https://app.any.run/tasks/12ae2ce1-b4bb-4259-84b9-1b3ecd1c5734
Verdict: Malicious activity
Analysis date: May 17, 2025, 20:57:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

79D81FFE01D8D526736E58C9D48324B3

SHA1:

450BCA55C673A17B9B8FD69799842755D0E2E2E0

SHA256:

30217AC7B9C113AEE33DAEFFB5B7ACA9C62F9F0A75E5636B2ECBB1F6ADCBD941

SSDEEP:

6144:I96cEqR1F6sCKKztZlKoi1PpNpNxUXE+v+5Ur:YVDVCKH1hNq0+W5Ur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of the domain to which a computer belongs via WMI (SCRIPT)

      • cscript.exe (PID: 1324)

  • SUSPICIOUS

    • The process executes VB scripts

      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 1348)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 4620)
      • wscript.exe (PID: 6652)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 4620)
      • wscript.exe (PID: 6652)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 4620)
      • wscript.exe (PID: 6652)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6564)
      • powershell.exe (PID: 4488)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Manipulates environment variables

      • powershell.exe (PID: 6564)
      • powershell.exe (PID: 4488)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 4408)
      • csc.exe (PID: 6344)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 4408)
      • expand.exe (PID: 5072)
      • csc.exe (PID: 6344)
      • expand.exe (PID: 5796)
      • cmd.exe (PID: 1348)

    • Unpacks CAB file

      • expand.exe (PID: 5072)
      • expand.exe (PID: 5796)

    • Process drops legitimate windows executable

      • expand.exe (PID: 5072)
      • expand.exe (PID: 5796)
      • cmd.exe (PID: 1348)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Connects to unusual port

      • SppExtComObj.Exe (PID: 4428)

    • Application launched itself

      • ClipUp.exe (PID: 5720)

  • INFO

    • Checks supported languages

      • mode.com (PID: 6712)
      • mode.com (PID: 3020)
      • mode.com (PID: 5024)
      • chcp.com (PID: 5116)
      • cvtres.exe (PID: 3888)
      • expand.exe (PID: 5072)
      • csc.exe (PID: 4408)
      • mode.com (PID: 4896)
      • mode.com (PID: 3272)
      • mode.com (PID: 5408)
      • chcp.com (PID: 864)
      • csc.exe (PID: 6344)
      • cvtres.exe (PID: 2240)
      • expand.exe (PID: 5796)
      • gatherosstatemodified.exe (PID: 4736)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6712)
      • mode.com (PID: 3020)
      • mode.com (PID: 5024)
      • mode.com (PID: 4896)
      • mode.com (PID: 3272)
      • mode.com (PID: 5408)

    • Changes the display of characters in the console

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 4408)
      • expand.exe (PID: 5072)
      • csc.exe (PID: 6344)
      • expand.exe (PID: 5796)
      • gatherosstatemodified.exe (PID: 4736)

    • Create files in a temporary directory

      • cvtres.exe (PID: 3888)
      • csc.exe (PID: 4408)
      • cvtres.exe (PID: 2240)
      • csc.exe (PID: 6344)
      • ClipUp.exe (PID: 5640)

    • The sample compiled with english language support

      • expand.exe (PID: 5072)
      • expand.exe (PID: 5796)
      • cmd.exe (PID: 1348)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Reads the software policy settings

      • slui.exe (PID: 5116)

    • Manual execution by a user

      • cmd.exe (PID: 3156)

    • Reads the computer name

      • gatherosstatemodified.exe (PID: 4736)

    • Creates files in the program directory

      • ClipUp.exe (PID: 5640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
199
Monitored processes
63
Malicious processes
14
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs mode.com no specs chcp.com no specs powershell.exe no specs sppextcomobj.exe slui.exe csc.exe cvtres.exe no specs expand.exe powershell.exe no specs powershell.exe no specs cscript.exe no specs cscript.exe no specs slui.exe no specs cscript.exe no specs slui.exe no specs cscript.exe no specs slui.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs mode.com no specs chcp.com no specs powershell.exe no specs csc.exe cvtres.exe no specs expand.exe powershell.exe no specs powershell.exe no specs cscript.exe no specs gatherosstatemodified.exe no specs clipup.exe no specs clipup.exe no specs conhost.exe no specs cscript.exe no specs Delivery Optimization Managment no specs slui.exe no specs slui.exe no specs cscript.exe no specs slui.exe no specs slui.exe no specs licensingui.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
864chcp 850 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1040powershell write-host -fore DarkGreen Enter a menu option on the Keyboard [1,2,3,4,5,6,7,8] :C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
1052powershell write-host -fore DarkGreen Enter a menu option on the Keyboard: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1272cscript //nologo C:\WINDOWS\system32\slmgr.vbs -xprC:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324cscript //nologo C:\WINDOWS\system32\slmgr.vbs -skms kms.03k.org C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\WACT_AIO.bat" ELEV C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1532"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\WACT_AIO.bat" ELEV C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1672powershell write-host -fore DarkGreen Enter a menu option on the Keyboard [1,2,3,4,5,6,7,8] :C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
Total events
46 969
Read events
46 965
Write events
4
Delete events
0

Modification events

(PID) Process:(4620) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(4620) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(5936) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config
Operation:writeName:DownloadMode_BackCompat
Value:
0
(PID) Process:(5936) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config
Operation:writeName:DODownloadMode
Value:
0
Executable files
7
Suspicious files
9
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
6564powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lwnzssah.fac.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6564powershell.exeC:\Users\admin\Desktop\1compressed
MD5:7492829A6D0BD32B501EB2C4938FE2EE
SHA256:1A258168F2B78A246D7C7A5F15CB07BF40564C08A18D9C9970AEE5191AFD00CC
6564powershell.exeC:\Users\admin\AppData\Local\Temp\g4kthcos\g4kthcos.cmdlinetext
MD5:10AF433A0EE85C98368D070E44A3C939
SHA256:67E6686C37BEDF903A1BA523F7D8A9F09F37D01FBB2EC20205BD89C0A27097E3
6564powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qyipngtb.11i.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4408csc.exeC:\Users\admin\AppData\Local\Temp\g4kthcos\g4kthcos.dllexecutable
MD5:CF772DB9446F2A186B6A0D1472E8DFCB
SHA256:F546BCDCD7A52E12EBA6229621EBDF16BC17B031002BA94E5445B41F2690B3BE
5072expand.exeC:\Users\admin\Desktop\gatherosstatemodified.exeexecutable
MD5:892FAE48577E46EABD9FBBC4107D924C
SHA256:4A6EBF681B69C0D28EBF51E6E6DA05974DC1166502B174293BC6585B0814DA7B
5072expand.exeC:\Windows\Logs\DPX\setupact.logcsv
MD5:A96A2F841A098E212B699BD5B0467756
SHA256:03D635F7144FFF12C344B9E5794A55AFC4B3FAB091101EF25FD04CF9BDA34AE7
6564powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:1810FF731A7B073D47F2777D403E71D7
SHA256:224DC24A5D2143A4574EC8ECD1E76ADBE55DD06B7DC570102E1BACCA15B65847
5972powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3jnpbetc.rto.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1672powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_a2f3zojd.jed.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.16:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.16:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.16
  • 23.216.77.18
  • 23.216.77.17
  • 23.216.77.27
  • 23.216.77.19
  • 23.216.77.26
  • 23.216.77.21
  • 23.216.77.20
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.131
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WACT_AIO.bat