File name:

85bfca17b11e73d65d36a61aa0b546dd68632797fc20c113e0e19792e7cd87a5.bat

Full analysis: https://app.any.run/tasks/944e2d7b-9b1b-408d-840b-49873a957141
Verdict: Malicious activity
Analysis date: June 11, 2025, 13:49:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (641), with CRLF line terminators
MD5:

C61C38D9399158A3E84B9FF22359196E

SHA1:

9D4B63B2C1497BE10683F6E21AD33F200C305BE4

SHA256:

85BFCA17B11E73D65D36A61AA0B546DD68632797FC20C113E0E19792E7CD87A5

SSDEEP:

49152:ETOB4ynYygOvXsMruROZyUpWvWOLZkORea:M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • cmd.exe (PID: 1520)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1948)
      • net.exe (PID: 6104)
      • net.exe (PID: 3644)

    • Registers / Runs the DLL via REGSVR32.EXE

      • cmd.exe (PID: 1948)

    • Creates or modifies Windows services

      • regsvr32.exe (PID: 3476)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1520)
      • cmd.exe (PID: 1948)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5168)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 5168)

    • The process executes VB scripts

      • cmd.exe (PID: 1520)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5168)
      • cmd.exe (PID: 1948)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1948)

    • Stops a currently running service

      • sc.exe (PID: 1880)
      • sc.exe (PID: 2716)
      • sc.exe (PID: 5432)
      • sc.exe (PID: 5168)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2460)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1948)

    • Application launched itself

      • cmd.exe (PID: 1948)

    • Sets the service to start on system boot

      • sc.exe (PID: 2536)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3620)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1948)

  • INFO

    • Create files in a temporary directory

      • mofcomp.exe (PID: 2368)
      • mofcomp.exe (PID: 2276)
      • mofcomp.exe (PID: 2044)
      • mofcomp.exe (PID: 6176)
      • mofcomp.exe (PID: 504)
      • mofcomp.exe (PID: 5612)
      • mofcomp.exe (PID: 3668)
      • mofcomp.exe (PID: 4864)
      • mofcomp.exe (PID: 6720)
      • mofcomp.exe (PID: 300)
      • mofcomp.exe (PID: 3196)
      • mofcomp.exe (PID: 1148)
      • mofcomp.exe (PID: 6220)
      • mofcomp.exe (PID: 1668)
      • mofcomp.exe (PID: 5900)
      • mofcomp.exe (PID: 6876)
      • mofcomp.exe (PID: 1636)
      • mofcomp.exe (PID: 5628)
      • mofcomp.exe (PID: 6460)
      • mofcomp.exe (PID: 4832)
      • mofcomp.exe (PID: 4500)
      • mofcomp.exe (PID: 2648)
      • mofcomp.exe (PID: 4760)
      • mofcomp.exe (PID: 4040)
      • mofcomp.exe (PID: 7060)
      • mofcomp.exe (PID: 3396)
      • mofcomp.exe (PID: 4868)
      • mofcomp.exe (PID: 3724)
      • mofcomp.exe (PID: 3836)
      • mofcomp.exe (PID: 6556)
      • mofcomp.exe (PID: 3832)
      • mofcomp.exe (PID: 1232)
      • mofcomp.exe (PID: 5080)
      • mofcomp.exe (PID: 5552)
      • mofcomp.exe (PID: 3656)
      • mofcomp.exe (PID: 2808)
      • mofcomp.exe (PID: 4224)
      • mofcomp.exe (PID: 4880)
      • mofcomp.exe (PID: 5124)
      • mofcomp.exe (PID: 1148)
      • mofcomp.exe (PID: 4836)
      • mofcomp.exe (PID: 2044)
      • mofcomp.exe (PID: 2976)
      • mofcomp.exe (PID: 5172)
      • mofcomp.exe (PID: 5904)
      • mofcomp.exe (PID: 5600)
      • mofcomp.exe (PID: 188)
      • mofcomp.exe (PID: 2188)
      • mofcomp.exe (PID: 304)
      • mofcomp.exe (PID: 6184)
      • mofcomp.exe (PID: 1480)
      • mofcomp.exe (PID: 5600)
      • mofcomp.exe (PID: 1688)
      • mofcomp.exe (PID: 3656)
      • mofcomp.exe (PID: 3956)
      • mofcomp.exe (PID: 5904)
      • mofcomp.exe (PID: 1232)
      • mofcomp.exe (PID: 5552)
      • mofcomp.exe (PID: 4460)
      • mofcomp.exe (PID: 2808)
      • mofcomp.exe (PID: 4224)
      • mofcomp.exe (PID: 6852)
      • mofcomp.exe (PID: 2216)
      • mofcomp.exe (PID: 728)
      • mofcomp.exe (PID: 3624)
      • mofcomp.exe (PID: 2608)
      • mofcomp.exe (PID: 1852)
      • mofcomp.exe (PID: 2216)
      • mofcomp.exe (PID: 5080)
      • mofcomp.exe (PID: 5172)
      • mofcomp.exe (PID: 3832)
      • mofcomp.exe (PID: 188)
      • mofcomp.exe (PID: 2348)
      • mofcomp.exe (PID: 3588)
      • mofcomp.exe (PID: 3388)
      • mofcomp.exe (PID: 6292)
      • mofcomp.exe (PID: 7164)
      • mofcomp.exe (PID: 592)
      • mofcomp.exe (PID: 4196)
      • mofcomp.exe (PID: 1036)
      • mofcomp.exe (PID: 1752)
      • mofcomp.exe (PID: 3100)
      • mofcomp.exe (PID: 7116)
      • mofcomp.exe (PID: 5772)
      • mofcomp.exe (PID: 6228)
      • mofcomp.exe (PID: 3476)
      • mofcomp.exe (PID: 1816)
      • mofcomp.exe (PID: 4760)
      • mofcomp.exe (PID: 4040)
      • mofcomp.exe (PID: 6404)
      • mofcomp.exe (PID: 2804)
      • mofcomp.exe (PID: 4192)
      • mofcomp.exe (PID: 5560)
      • mofcomp.exe (PID: 3836)
      • mofcomp.exe (PID: 6380)
      • mofcomp.exe (PID: 4580)
      • mofcomp.exe (PID: 3084)
      • mofcomp.exe (PID: 3876)
      • mofcomp.exe (PID: 2936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.bib/bibtex/txt | BibTeX references (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
804
Monitored processes
655
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs wmiprvse.exe no specs winmgmt.exe no specs sc.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs slui.exe mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188mofcomp C:\Windows\System32\wbem\hnetcfg.mofC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
188mofcomp C:\Windows\System32\wbem\Microsoft-Windows-OfflineFiles.mofC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
188mofcomp C:\Windows\System32\wbem\en-US\win32_printer.mflC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
236mofcomp C:\Windows\System32\wbem\vds.mofC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
236mofcomp C:\Windows\System32\wbem\en-US\OfflineFilesConfigurationWmiProvider_Uninstall.mflC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
300mofcomp C:\Windows\System32\wbem\BthMtpEnum.mofC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
300mofcomp C:\Windows\System32\wbem\NetAdapterCimTraceUninstall.mofC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
300mofcomp C:\Windows\System32\wbem\en-US\wmipdskq.mflC:\Windows\System32\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\kernel.appcore.dll
304regsvr32 /s mofd.dllC:\Windows\System32\regsvr32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
304regsvr32 /s WmiApRpl.dllC:\Windows\System32\regsvr32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
43 465
Read events
43 348
Write events
63
Delete events
54

Modification events

(PID) Process:(1520) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\InProcServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\TypeLib
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\Version
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\InProcServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\TypeLib
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\Version
Operation:delete keyName:(default)
Value:
(PID) Process:(3620) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
443
Text files
274
Unknown types
2

Dropped files

PID
Process
Filename
Type
304regsvr32.exeC:\Windows\System32\wbem\Performance\WmiApRpl.initext
MD5:A656A56B1FDA4AA28383160BA6EBEA3B
SHA256:639CF8ACD1FE25A19B9841C9262B4227FCC33BB6658919D31B10AB849253B318
304regsvr32.exeC:\Windows\System32\wbem\Performance\WmiApRpl_new.initext
MD5:A656A56B1FDA4AA28383160BA6EBEA3B
SHA256:639CF8ACD1FE25A19B9841C9262B4227FCC33BB6658919D31B10AB849253B318
304regsvr32.exeC:\Windows\System32\perfc009.datbinary
MD5:70F563F09911874820858AC3838CBCFF
SHA256:14221E7DD1645343BA61CCA5DB0EAD8232381A783D0B46B1335F975D521AB010
1520cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:D14A6C18536B08C2D91CC10129CEC2CA
SHA256:88F0E55BE41422957E8F4FEC8CAF0F9ED4E68D1F0290171BA8F4BD26C19FA17D
304regsvr32.exeC:\Windows\System32\PerfStringBackup.TMPbinary
MD5:F18381515190127E62A065185E80CB33
SHA256:ECCE1C29FD95FD6F62C89AB2B238EFF87D1810493A8DF2CCC89FF39C424EAD60
304regsvr32.exeC:\Windows\System32\perfh009.datbinary
MD5:D471F8A34C306F9A0BB9FB7FC8EDDBCA
SHA256:E69B677A12B4D1F6FB7E939F92077EDCCDD06F685F92D75385E2A718BF03EB80
304regsvr32.exeC:\Windows\INF\WmiApRpl\WmiApRpl.initext
MD5:A656A56B1FDA4AA28383160BA6EBEA3B
SHA256:639CF8ACD1FE25A19B9841C9262B4227FCC33BB6658919D31B10AB849253B318
304regsvr32.exeC:\Windows\System32\PerfStringBackup.INIbinary
MD5:F18381515190127E62A065185E80CB33
SHA256:ECCE1C29FD95FD6F62C89AB2B238EFF87D1810493A8DF2CCC89FF39C424EAD60
304regsvr32.exeC:\Windows\System32\wbem\Performance\WmiApRpl.htext
MD5:1CC4C3B9BB1657BE77939F0B565E315D
SHA256:9EB3CBB0F65809845890159EFDAB0FF5A910DA34252E7D5CFF2929CC2FA6AB6A
304regsvr32.exeC:\Windows\INF\WmiApRpl\WmiApRpl.htext
MD5:1CC4C3B9BB1657BE77939F0B565E315D
SHA256:9EB3CBB0F65809845890159EFDAB0FF5A910DA34252E7D5CFF2929CC2FA6AB6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
29
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2460
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2460
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
1652
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
728
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2524
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3732
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2460
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
login.live.com
  • 20.190.159.129
  • 40.126.31.131
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.2
  • 40.126.31.71
  • 40.126.31.1
  • 40.126.31.128
  • 20.190.159.71
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.131
  • 20.190.159.130
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
x1.c.lencr.org
  • 23.209.209.135
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
85bfca17b11e73d65d36a61aa0b546dd68632797fc20c113e0e19792e7cd87a5.bat