URL:

https://github.com/teknixstuff/revert8plus/releases/download/1106/r8p.exe

Full analysis: https://app.any.run/tasks/f0a0ea97-9ecd-429b-b6c9-3b5f95c01ed4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 01, 2025, 15:22:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ahk
loader
arch-scr
Indicators:
MD5:

FEA0AA4EC6049B27D8BE2BABFA112830

SHA1:

8CA6456E009BC4E16F3B4589059FCC719BAFB7CD

SHA256:

1156001613D3DCFD7B93F520AEAC9B6742AF9DB96CB51E3707348524B8870DC8

SSDEEP:

3:N8tEdhAXfMAW7VeiArkCUMGEA:2uwX0XIiM6MGEA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AHK has been detected (YARA)

      • r8p.exe (PID: 7536)

    • Adds path to the Windows Defender exclusion list

      • r8p.exe (PID: 7536)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6680)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 6856)

    • Create files in the Startup directory

      • msiexec.exe (PID: 7476)

    • Executing a file with an untrusted certificate

      • SetACL.exe (PID: 7472)
      • SetACL.exe (PID: 7024)
      • SetACL.exe (PID: 6084)
      • SetACL.exe (PID: 4012)

    • Uses Task Scheduler to run other applications

      • msiexec.exe (PID: 4444)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 7476)

    • Starts POWERSHELL.EXE for commands execution

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 6856)

    • There is functionality for taking screenshot (YARA)

      • r8p.exe (PID: 7536)

    • Script adds exclusion path to Windows Defender

      • r8p.exe (PID: 7536)

    • Creates a software uninstall entry

      • r8p.exe (PID: 7536)

    • Executable content was dropped or overwritten

      • r8p.exe (PID: 7536)
      • 7za.exe (PID: 6372)
      • powershell.exe (PID: 6680)

    • Drops 7-zip archiver for unpacking

      • r8p.exe (PID: 7536)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 7za.exe (PID: 6372)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 6372)
      • powershell.exe (PID: 6680)
      • msiexec.exe (PID: 7476)

    • The process creates files with name similar to system file names

      • 7za.exe (PID: 6372)
      • powershell.exe (PID: 6680)
      • msiexec.exe (PID: 7476)

    • Reads security settings of Internet Explorer

      • r8p.exe (PID: 7536)
      • DismHost.exe (PID: 6548)
      • msiexec.exe (PID: 4444)

    • Changes default file association

      • reg.exe (PID: 8060)
      • reg.exe (PID: 7252)
      • reg.exe (PID: 5640)

    • Creates/Modifies COM task schedule object

      • reg.exe (PID: 8060)
      • reg.exe (PID: 7252)
      • reg.exe (PID: 5640)
      • reg.exe (PID: 6560)
      • reg.exe (PID: 3464)
      • reg.exe (PID: 5096)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7476)

    • Uses REG/REGEDIT.EXE to modify registry

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 4444)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 6856)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6856)

    • Gets information about processes (POWERSHELL)

      • powershell.exe (PID: 6680)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 6856)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6680)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 6548)

    • Adds/modifies Windows certificates

      • msiexec.exe (PID: 7476)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 4444)

    • Starts SC.EXE for service management

      • msiexec.exe (PID: 4444)

    • Creates a new Windows service

      • sc.exe (PID: 5988)
      • sc.exe (PID: 6588)
      • sc.exe (PID: 6268)

    • Creates or modifies Windows services

      • reg.exe (PID: 5096)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 6392)
      • msedge.exe (PID: 6224)
      • msiexec.exe (PID: 7476)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6392)
      • msiexec.exe (PID: 7476)
      • msedge.exe (PID: 1400)

    • Checks supported languages

      • r8p.exe (PID: 7536)
      • identity_helper.exe (PID: 1556)
      • identity_helper.exe (PID: 7712)
      • 7za.exe (PID: 7956)
      • 7za.exe (PID: 6372)
      • msiexec.exe (PID: 7476)
      • msiexec.exe (PID: 6856)
      • DismHost.exe (PID: 6548)
      • msiexec.exe (PID: 7668)
      • ngen.exe (PID: 6348)
      • msiexec.exe (PID: 4444)
      • ngen.exe (PID: 5200)
      • ngen.exe (PID: 7312)
      • ngen.exe (PID: 7872)
      • ngen.exe (PID: 7300)
      • ngen.exe (PID: 6800)
      • ngen.exe (PID: 6252)
      • ngen.exe (PID: 8076)
      • ngen.exe (PID: 736)
      • ngen.exe (PID: 6752)
      • ngen.exe (PID: 7112)
      • ngen.exe (PID: 7084)
      • ngen.exe (PID: 7876)
      • ngen.exe (PID: 900)
      • ngen.exe (PID: 8032)
      • ngen.exe (PID: 7220)
      • ngen.exe (PID: 7624)
      • ngen.exe (PID: 4976)
      • ngen.exe (PID: 7620)
      • ngen.exe (PID: 7720)
      • ngen.exe (PID: 1224)
      • ngen.exe (PID: 6660)
      • ngen.exe (PID: 7176)
      • ngen.exe (PID: 7792)
      • ngen.exe (PID: 7368)
      • ngen.exe (PID: 1216)
      • ngen.exe (PID: 7640)
      • ngen.exe (PID: 7592)
      • ngen.exe (PID: 5912)
      • ngen.exe (PID: 7920)
      • ngen.exe (PID: 1888)
      • ngen.exe (PID: 6420)
      • ngen.exe (PID: 2624)
      • ngen.exe (PID: 7284)
      • ngen.exe (PID: 8152)
      • ngen.exe (PID: 6976)
      • ngen.exe (PID: 2484)
      • ngen.exe (PID: 2976)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 7244)
      • ngen.exe (PID: 7192)
      • ngen.exe (PID: 7000)
      • ngen.exe (PID: 7004)
      • SetACL.exe (PID: 6948)
      • SetACL.exe (PID: 7468)
      • SetACL.exe (PID: 6084)
      • SetACL.exe (PID: 7024)
      • SetACL.exe (PID: 1348)
      • SetACL.exe (PID: 1704)
      • SetACL.exe (PID: 7696)
      • SetACL.exe (PID: 2164)
      • SetACL.exe (PID: 7472)

    • Reads Environment values

      • identity_helper.exe (PID: 7712)
      • identity_helper.exe (PID: 1556)
      • DismHost.exe (PID: 6548)

    • Reads the computer name

      • identity_helper.exe (PID: 7712)
      • identity_helper.exe (PID: 1556)
      • r8p.exe (PID: 7536)
      • 7za.exe (PID: 6372)
      • 7za.exe (PID: 7956)
      • msiexec.exe (PID: 7476)
      • msiexec.exe (PID: 6856)
      • DismHost.exe (PID: 6548)
      • msiexec.exe (PID: 7668)
      • msiexec.exe (PID: 4444)
      • ngen.exe (PID: 6348)
      • ngen.exe (PID: 5200)
      • ngen.exe (PID: 7300)
      • ngen.exe (PID: 6800)
      • ngen.exe (PID: 7312)
      • ngen.exe (PID: 6252)
      • ngen.exe (PID: 8076)
      • ngen.exe (PID: 7872)
      • ngen.exe (PID: 736)
      • ngen.exe (PID: 6752)
      • ngen.exe (PID: 7112)
      • ngen.exe (PID: 7084)
      • ngen.exe (PID: 7876)
      • ngen.exe (PID: 900)
      • ngen.exe (PID: 7220)
      • ngen.exe (PID: 7624)
      • ngen.exe (PID: 4976)
      • ngen.exe (PID: 7620)
      • ngen.exe (PID: 8032)
      • ngen.exe (PID: 7720)
      • ngen.exe (PID: 1224)
      • ngen.exe (PID: 7176)
      • ngen.exe (PID: 1216)
      • ngen.exe (PID: 7792)
      • ngen.exe (PID: 7368)
      • ngen.exe (PID: 6660)
      • ngen.exe (PID: 7592)
      • ngen.exe (PID: 5912)
      • ngen.exe (PID: 7920)
      • ngen.exe (PID: 1888)
      • ngen.exe (PID: 6420)
      • ngen.exe (PID: 2624)
      • ngen.exe (PID: 7640)
      • ngen.exe (PID: 8152)
      • ngen.exe (PID: 6976)
      • ngen.exe (PID: 2484)
      • ngen.exe (PID: 2976)
      • ngen.exe (PID: 7244)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 7284)
      • ngen.exe (PID: 7192)
      • ngen.exe (PID: 7000)
      • ngen.exe (PID: 7004)
      • SetACL.exe (PID: 6948)
      • SetACL.exe (PID: 7468)
      • SetACL.exe (PID: 7472)
      • SetACL.exe (PID: 6084)
      • SetACL.exe (PID: 7024)
      • SetACL.exe (PID: 1348)
      • SetACL.exe (PID: 1704)
      • SetACL.exe (PID: 7696)
      • SetACL.exe (PID: 2164)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6948)
      • powershell.exe (PID: 7008)
      • powershell.exe (PID: 6656)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6948)
      • powershell.exe (PID: 6656)
      • powershell.exe (PID: 6832)
      • powershell.exe (PID: 7008)
      • powershell.exe (PID: 6680)

    • Reads the software policy settings

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 7476)

    • Detects AutoHotkey samples (YARA)

      • r8p.exe (PID: 7536)

    • Checks proxy server information

      • r8p.exe (PID: 7536)

    • Create files in a temporary directory

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 7476)
      • msiexec.exe (PID: 7668)
      • DismHost.exe (PID: 6548)

    • The sample compiled with english language support

      • r8p.exe (PID: 7536)
      • 7za.exe (PID: 6372)
      • powershell.exe (PID: 6680)
      • msiexec.exe (PID: 7476)
      • msedge.exe (PID: 1400)

    • The sample compiled with arabic language support

      • 7za.exe (PID: 6372)

    • Reads the machine GUID from the registry

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 7476)
      • DismHost.exe (PID: 6548)
      • msiexec.exe (PID: 4444)

    • Creates files or folders in the user directory

      • r8p.exe (PID: 7536)
      • msiexec.exe (PID: 7476)

    • Creates files in the program directory

      • r8p.exe (PID: 7536)
      • DismHost.exe (PID: 6548)

    • The executable file from the user directory is run by the Powershell process

      • DismHost.exe (PID: 6548)

    • Write to the desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 7476)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7476)

    • NGen native .NET image generation

      • ngen.exe (PID: 6348)
      • ngen.exe (PID: 5200)
      • ngen.exe (PID: 7312)
      • ngen.exe (PID: 7300)
      • ngen.exe (PID: 6252)
      • ngen.exe (PID: 8076)
      • ngen.exe (PID: 7872)
      • ngen.exe (PID: 6800)
      • ngen.exe (PID: 6752)
      • ngen.exe (PID: 7084)
      • ngen.exe (PID: 7112)
      • ngen.exe (PID: 7876)
      • ngen.exe (PID: 1224)
      • ngen.exe (PID: 900)
      • ngen.exe (PID: 736)
      • ngen.exe (PID: 7220)
      • ngen.exe (PID: 7624)
      • ngen.exe (PID: 4976)
      • ngen.exe (PID: 8032)
      • ngen.exe (PID: 7620)
      • ngen.exe (PID: 7720)
      • ngen.exe (PID: 6660)
      • ngen.exe (PID: 7176)
      • ngen.exe (PID: 7792)
      • ngen.exe (PID: 7368)
      • ngen.exe (PID: 1216)
      • ngen.exe (PID: 7640)
      • ngen.exe (PID: 7592)
      • ngen.exe (PID: 7920)
      • ngen.exe (PID: 5912)
      • ngen.exe (PID: 1888)
      • ngen.exe (PID: 6420)
      • ngen.exe (PID: 2624)
      • ngen.exe (PID: 7284)
      • ngen.exe (PID: 2484)
      • ngen.exe (PID: 6976)
      • ngen.exe (PID: 2976)
      • ngen.exe (PID: 836)
      • ngen.exe (PID: 7244)
      • ngen.exe (PID: 8152)
      • ngen.exe (PID: 7000)
      • ngen.exe (PID: 7004)
      • ngen.exe (PID: 7192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
489
Monitored processes
348
Malicious processes
13
Suspicious processes
5

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs r8p.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #AHK r8p.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs 7za.exe no specs conhost.exe no specs 7za.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs powershell.exe conhost.exe no specs msedge.exe no specs dismhost.exe msiexec.exe no specs msiexec.exe no specs msedge.exe msiexec.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs ngen.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs setacl.exe no specs conhost.exe no specs w7gadgets.exe no specs w7gadgets.tmp no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
624"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4880 --field-trial-handle=2364,i,6815184454206875311,16258259731822899695,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.iTV.Media, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
4294967295
Version:
4.8.9093.0 built by: NET481REL1LAST_C
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\ngen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
776"C:\WINDOWS\System32\cmd.exe" /c mklink /j "C:\WINDOWS\ehome" "C:\Program Files\Windows Media Center\ehome"C:\Windows\System32\cmd.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ngen.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
836"C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "mcstoredb, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=x86" /NoDependencies /queue:1C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
4294967295
Version:
4.8.9093.0 built by: NET481REL1LAST_C
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
900"C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "mcepg, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
4294967295
Version:
4.8.9093.0 built by: NET481REL1LAST_C
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\ngen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1016"C:\WINDOWS\System32\cmd.exe" /c mklink /h "C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\ehiiTV\v4.0_6.3.0.0__31bf3856ad364e35\ehiiTV.dll" "C:\Program Files\Windows Media Center\ehome\ehiiTV.dll"C:\Windows\System32\cmd.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
54 016
Read events
50 679
Write events
3 324
Delete events
13

Modification events

(PID) Process:(3832) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3832) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3832) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3832) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3832) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3832) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
Executable files
692
Suspicious files
598
Text files
1 247
Unknown types
3

Dropped files

PID
Process
Filename
Type
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF135af4.TMP —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF135b04.TMP —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF135b04.TMP —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF135b04.TMP —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF135af4.TMP —
MD5:—
SHA256:—
6392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
79
DNS requests
80
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5964
RUXIMICS.exe
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5964
RUXIMICS.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7536
r8p.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
6584
svchost.exe
HEAD
200
95.101.78.48:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1738728204&P2=404&P3=2&P4=LY0SZreSVk%2fvOadd52qT8E1NscPXOYw4t1zSwr0tyWp1B40chS4lbT2JiQ0WKg%2b2baM94UoqGm0NonetsMncvA%3d%3d
unknown
—
—
whitelisted
7536
r8p.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
7536
r8p.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
7536
r8p.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
whitelisted
6584
svchost.exe
GET
206
95.101.78.48:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1738728204&P2=404&P3=2&P4=LY0SZreSVk%2fvOadd52qT8E1NscPXOYw4t1zSwr0tyWp1B40chS4lbT2JiQ0WKg%2b2baM94UoqGm0NonetsMncvA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3508
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5964
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
92.123.104.20:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6392
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6636
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6636
msedge.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted
6636
msedge.exe
92.123.104.20:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6636
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.4
whitelisted
www.bing.com
  • 92.123.104.20
  • 92.123.104.9
  • 92.123.104.58
  • 92.123.104.17
  • 92.123.104.65
  • 92.123.104.64
  • 92.123.104.10
  • 92.123.104.66
  • 92.123.104.5
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 95.101.78.48
  • 95.101.78.32
whitelisted
crl.microsoft.com
  • 95.101.78.32
  • 95.101.78.42
  • 2.16.164.104
  • 2.16.164.131
  • 2.16.164.107
  • 2.16.164.128
  • 2.16.164.112
  • 2.16.164.17
  • 2.16.164.9
  • 2.16.164.11
  • 2.16.164.98
whitelisted
objects.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.110.133
shared
edgeservices.bing.com
  • 92.123.104.20
  • 92.123.104.9
  • 92.123.104.58
  • 92.123.104.17
  • 92.123.104.65
  • 92.123.104.64
  • 92.123.104.10
  • 92.123.104.66
  • 92.123.104.5
whitelisted

Threats

No threats detected
Process
Message
powershell.exe
PID=6680 TID=6772 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 DismApi.dll: - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 Input parameters: LogLevel: 2, LogFilePath: C:\WINDOWS\Logs\DISM\dism.log, ScratchDirectory: (null) - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 DismApi.dll: Host machine information: OS Version=10.0.19045, Running architecture=amd64, Number of processors=4 - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 DismApi.dll: API Version 10.0.19041.3758 - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 DismApi.dll: Parent process command line: "PowerShell" -NoProfile -NonInteractive -InputFormat None -ExecutionPolicy Bypass "C:\Users\admin\AppData\Local\Temp\InstallDVDAppxPackage\DvdInstall.ps1" "C:\Users\admin\AppData\Local\Temp\InstallDVDAppxPackage\50ea4d02e68f4217869d054e06374b74.appxbundle" "C:\Users\admin\AppData\Local\Temp\InstallDVDAppxPackage\50ea4d02e68f4217869d054e06374b74_License1.xml" - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 Enter DismInitializeInternal - DismInitializeInternal
powershell.exe
PID=6680 TID=6772 Lookup in table by path failed for: DummyPath-2BA51B78-C7F7-4910-B99D-BB7345357CDC - CTransactionalImageTable::LookupImagePath
powershell.exe
PID=6680 TID=7160 Enter CCommandThread::CommandThreadProcedureStub - CCommandThread::CommandThreadProcedureStub
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/teknixstuff/revert8plus/releases/download/1106/r8p.exe