Should I block it?
No, this file is 100% safe to run.
Additional versions
Relationships
cscript.exe
Microsoft Windows Script Host by Microsoft
| Version: | 5.8.9200.16384 |
| MD5: | 2e8d4a6fedf90e265d2370a543b4fd2a |
| SHA1: | d9e31228f75e6bf53ee112b84fca89fc0fa7eba8 |
| SHA256: | 4747d091f230bf409af6a42c32cca30d845541d2c3200bb275f0fa179bd5e082 |
This is a Windows system installed file with Windows File Protection (WFP) enabled.
Overview
cscript.exe adds run once key to the current user's profile so that the file will execute the next time the user logs into Windows (it will delete the entry after it runs once).
Details
| File name: | cscript.exe |
| Publisher: | Microsoft Corporation |
| Product name: | Microsoft ® Windows Script Host |
| Description: | Microsoft ® Console Based Script Host |
| Typical file path: | C:\windows\syswow64\cscript.exe |
| Original name: | cscript.exe.mui |
| File version: | 5.8.9200.16384 |
| Size: | 143.5 KB (146,944 bytes) |
| Digital DNA |
| File packed: | No |
| .NET CLR: | No |
More details
Behaviors
Shell open commands
- vbefile
- VBSFile
- jsefile
- JSFile
Scheduled tasks
- The job '060184C3-9766-46a0-B258-F4518A0B2633' runs on logon in the path '\060184C3-9766-46a0-B258-F4518A0B2633'
- Entry path '\Microsoft\Windows\Server Manager\CleanupOldPerfLogs'
Startup files (user) run once
Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
- 'Ignite' → C:\Windows\System32\cscript.exe "C:\users\user\appdata\Local\Temp\kill_Ignite_runonce.vbs"
Scheduled tasks startups
Set to load on user login (bypasses Windows UAC if enabled)
- Login entry path '\060184C3-9766-46a0-B258-F4518A0B2633'
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Ultimate |
38.78% |
|
| Windows 7 Home Premium |
28.57% |
|
| Windows 8 Pro with Media Center |
10.20% |
|
| Windows 8 |
8.16% |
|
| Windows 8.1 |
6.12% |
|
| Windows 8 Single Language |
2.04% |
|
| Windows 8.1 Pro |
2.04% |
|
| Windows 8.1 Single Language |
2.04% |
|
| Windows Server 2012 Standard Evaluation |
2.04% |
|
Distribution by country
Ireland installs about 17.78% of Microsoft ® Windows Script Host.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Acer |
39.47% |
|
| GIGABYTE |
21.05% |
|
| Hewlett-Packard |
15.79% |
|
| Lenovo |
10.53% |
|
| Medion |
5.26% |
|
| Sony |
5.26% |
|
| Samsung |
2.63% |
|
