File name:

WACT_AIO.bat

Full analysis: https://app.any.run/tasks/12ae2ce1-b4bb-4259-84b9-1b3ecd1c5734
Verdict: Malicious activity
Analysis date: May 17, 2025, 20:57:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

79D81FFE01D8D526736E58C9D48324B3

SHA1:

450BCA55C673A17B9B8FD69799842755D0E2E2E0

SHA256:

30217AC7B9C113AEE33DAEFFB5B7ACA9C62F9F0A75E5636B2ECBB1F6ADCBD941

SSDEEP:

6144:I96cEqR1F6sCKKztZlKoi1PpNpNxUXE+v+5Ur:YVDVCKH1hNq0+W5Ur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of the domain to which a computer belongs via WMI (SCRIPT)

      • cscript.exe (PID: 1324)

  • SUSPICIOUS

    • The process executes VB scripts

      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 1348)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 4620)
      • wscript.exe (PID: 6652)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 4620)
      • wscript.exe (PID: 6652)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 4620)
      • wscript.exe (PID: 6652)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6564)
      • powershell.exe (PID: 4488)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Manipulates environment variables

      • powershell.exe (PID: 6564)
      • powershell.exe (PID: 4488)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 4408)
      • csc.exe (PID: 6344)

    • Executable content was dropped or overwritten

      • expand.exe (PID: 5072)
      • csc.exe (PID: 4408)
      • expand.exe (PID: 5796)
      • cmd.exe (PID: 1348)
      • csc.exe (PID: 6344)

    • Process drops legitimate windows executable

      • expand.exe (PID: 5072)
      • cmd.exe (PID: 1348)
      • expand.exe (PID: 5796)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Unpacks CAB file

      • expand.exe (PID: 5072)
      • expand.exe (PID: 5796)

    • Connects to unusual port

      • SppExtComObj.Exe (PID: 4428)

    • Application launched itself

      • ClipUp.exe (PID: 5720)

  • INFO

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6712)
      • mode.com (PID: 5024)
      • mode.com (PID: 3020)
      • mode.com (PID: 4896)
      • mode.com (PID: 3272)
      • mode.com (PID: 5408)

    • Checks supported languages

      • mode.com (PID: 3020)
      • chcp.com (PID: 5116)
      • csc.exe (PID: 4408)
      • cvtres.exe (PID: 3888)
      • mode.com (PID: 6712)
      • mode.com (PID: 5024)
      • expand.exe (PID: 5072)
      • mode.com (PID: 4896)
      • mode.com (PID: 3272)
      • mode.com (PID: 5408)
      • chcp.com (PID: 864)
      • csc.exe (PID: 6344)
      • cvtres.exe (PID: 2240)
      • gatherosstatemodified.exe (PID: 4736)
      • expand.exe (PID: 5796)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 4408)
      • expand.exe (PID: 5072)
      • csc.exe (PID: 6344)
      • gatherosstatemodified.exe (PID: 4736)
      • expand.exe (PID: 5796)

    • Create files in a temporary directory

      • cvtres.exe (PID: 3888)
      • csc.exe (PID: 4408)
      • csc.exe (PID: 6344)
      • cvtres.exe (PID: 2240)
      • ClipUp.exe (PID: 5640)

    • Changes the display of characters in the console

      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1348)

    • The sample compiled with english language support

      • expand.exe (PID: 5072)
      • expand.exe (PID: 5796)
      • cmd.exe (PID: 1348)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 1324)
      • cscript.exe (PID: 7148)
      • cscript.exe (PID: 1272)
      • cscript.exe (PID: 6760)
      • cscript.exe (PID: 3124)
      • cscript.exe (PID: 4164)

    • Manual execution by a user

      • cmd.exe (PID: 3156)

    • Reads the software policy settings

      • slui.exe (PID: 5116)

    • Reads the computer name

      • gatherosstatemodified.exe (PID: 4736)

    • Creates files in the program directory

      • ClipUp.exe (PID: 5640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
199
Monitored processes
63
Malicious processes
14
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs mode.com no specs chcp.com no specs powershell.exe no specs sppextcomobj.exe slui.exe csc.exe cvtres.exe no specs expand.exe powershell.exe no specs powershell.exe no specs cscript.exe no specs cscript.exe no specs slui.exe no specs cscript.exe no specs slui.exe no specs cscript.exe no specs slui.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs mode.com no specs net.exe no specs net1.exe no specs mode.com no specs chcp.com no specs powershell.exe no specs csc.exe cvtres.exe no specs expand.exe powershell.exe no specs powershell.exe no specs cscript.exe no specs gatherosstatemodified.exe no specs clipup.exe no specs clipup.exe no specs conhost.exe no specs cscript.exe no specs Delivery Optimization Managment no specs slui.exe no specs slui.exe no specs cscript.exe no specs slui.exe no specs slui.exe no specs licensingui.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
864chcp 850 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1040powershell write-host -fore DarkGreen Enter a menu option on the Keyboard [1,2,3,4,5,6,7,8] :C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
1052powershell write-host -fore DarkGreen Enter a menu option on the Keyboard: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1272cscript //nologo C:\WINDOWS\system32\slmgr.vbs -xprC:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324cscript //nologo C:\WINDOWS\system32\slmgr.vbs -skms kms.03k.org C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\WACT_AIO.bat" ELEV C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1532"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\WACT_AIO.bat" ELEV C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1672powershell write-host -fore DarkGreen Enter a menu option on the Keyboard [1,2,3,4,5,6,7,8] :C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
Total events
46 969
Read events
46 965
Write events
4
Delete events
0

Modification events

(PID) Process:(4620) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(4620) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(5936) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config
Operation:writeName:DownloadMode_BackCompat
Value:
0
(PID) Process:(5936) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config
Operation:writeName:DODownloadMode
Value:
0
Executable files
7
Suspicious files
9
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
6564powershell.exeC:\Users\admin\AppData\Local\Temp\g4kthcos\g4kthcos.0.cstext
MD5:047F0CF592670E8FCA358F12E4CD5A89
SHA256:32E77D9085AD9EA0FD1EB5A9556E29CB42F5D3016CCF9853F3C39D358F479978
2088powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_n0lcc5we.o33.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6564powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lwnzssah.fac.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6564powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qyipngtb.11i.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6564powershell.exeC:\Users\admin\AppData\Local\Temp\g4kthcos\g4kthcos.cmdlinetext
MD5:10AF433A0EE85C98368D070E44A3C939
SHA256:67E6686C37BEDF903A1BA523F7D8A9F09F37D01FBB2EC20205BD89C0A27097E3
5072expand.exeC:\Windows\Logs\DPX\setupact.logcsv
MD5:A96A2F841A098E212B699BD5B0467756
SHA256:03D635F7144FFF12C344B9E5794A55AFC4B3FAB091101EF25FD04CF9BDA34AE7
6564powershell.exeC:\Users\admin\Desktop\1compressed
MD5:7492829A6D0BD32B501EB2C4938FE2EE
SHA256:1A258168F2B78A246D7C7A5F15CB07BF40564C08A18D9C9970AEE5191AFD00CC
6564powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:1810FF731A7B073D47F2777D403E71D7
SHA256:224DC24A5D2143A4574EC8ECD1E76ADBE55DD06B7DC570102E1BACCA15B65847
5072expand.exeC:\Users\admin\Desktop\gatherosstatemodified.exeexecutable
MD5:892FAE48577E46EABD9FBBC4107D924C
SHA256:4A6EBF681B69C0D28EBF51E6E6DA05974DC1166502B174293BC6585B0814DA7B
3888cvtres.exeC:\Users\admin\AppData\Local\Temp\RESDC29.tmpbinary
MD5:1636BD4E8AAB045AFEF65289AEA22959
SHA256:15DA73103FA8EECB8E807B3280EEBE6486EBEBD4FEF6B5FCBE0F9B4D306AE138
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.16:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.16:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.16
  • 23.216.77.18
  • 23.216.77.17
  • 23.216.77.27
  • 23.216.77.19
  • 23.216.77.26
  • 23.216.77.21
  • 23.216.77.20
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.131
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WACT_AIO.bat