| URL: | http://github.com/teknixstuff/revert8plus/releases/download/1137/r8p.exe |
| Full analysis: | https://app.any.run/tasks/57d70e01-3e53-4731-9748-a6eda0d08e4f |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 04, 2025, 18:13:41 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 40B7BA6DB6B1719486FA15067ABB34A6 |
| SHA1: | 0E76C0744836D3D5774FB443A9748EAF2A74E2C9 |
| SHA256: | 3DF9ED124E89CE4196420A6B5BB98AC8A39FDA0C11E2F21D60E736DCBCB7E40A |
| SSDEEP: | 3:N1KZMRidhAXfMAW7VeiArkCUP5NVLAdA:CyEwX0XIiM6t4A |
MALICIOUS
AHK has been detected (YARA)
- r8p.exe (PID: 6964)
Adds path to the Windows Defender exclusion list
- r8p.exe (PID: 6964)
Changes powershell execution policy (Bypass)
- msiexec.exe (PID: 7984)
Bypass execution policy to execute commands
- powershell.exe (PID: 6184)
Create files in the Startup directory
- msiexec.exe (PID: 7804)
Executing a file with an untrusted certificate
- SetACL.exe (PID: 616)
- SetACL.exe (PID: 3032)
- SetACL.exe (PID: 4120)
- SetACL.exe (PID: 7828)
- SetACL.exe (PID: 7996)
- SetACL.exe (PID: 2568)
- SetACL.exe (PID: 7868)
- SetACL.exe (PID: 6028)
- SetACL.exe (PID: 5132)
- SetACL.exe (PID: 1312)
Uses Task Scheduler to run other applications
- msiexec.exe (PID: 8032)
Registers / Runs the DLL via REGSVR32.EXE
- W7Gadgets.tmp (PID: 5408)
SUSPICIOUS
There is functionality for taking screenshot (YARA)
- r8p.exe (PID: 6964)
Starts POWERSHELL.EXE for commands execution
- r8p.exe (PID: 6964)
- msiexec.exe (PID: 7984)
Script adds exclusion path to Windows Defender
- r8p.exe (PID: 6964)
Creates a software uninstall entry
- r8p.exe (PID: 6964)
Reads security settings of Internet Explorer
- r8p.exe (PID: 6964)
- ShellExperienceHost.exe (PID: 1616)
- DismHost.exe (PID: 6584)
Drops 7-zip archiver for unpacking
- r8p.exe (PID: 6964)
Executable content was dropped or overwritten
- r8p.exe (PID: 6964)
- 7za.exe (PID: 2416)
- powershell.exe (PID: 6184)
- W7Gadgets.exe (PID: 4284)
- W7Gadgets.tmp (PID: 5408)
- W7Games.exe (PID: 5164)
Process drops legitimate windows executable
- 7za.exe (PID: 2416)
- r8p.exe (PID: 6964)
- msiexec.exe (PID: 7804)
- powershell.exe (PID: 6184)
- W7Gadgets.tmp (PID: 5408)
- W7Games.exe (PID: 5164)
The process creates files with name similar to system file names
- 7za.exe (PID: 2416)
- powershell.exe (PID: 6184)
- msiexec.exe (PID: 7804)
Write to the desktop.ini file (may be used to cloak folders)
- 7za.exe (PID: 2416)
Uses REG/REGEDIT.EXE to modify registry
- r8p.exe (PID: 6964)
- msiexec.exe (PID: 8032)
- W7Gadgets.tmp (PID: 5408)
Creates/Modifies COM task schedule object
- reg.exe (PID: 6960)
- reg.exe (PID: 1672)
- reg.exe (PID: 3768)
- reg.exe (PID: 5404)
- reg.exe (PID: 2852)
- reg.exe (PID: 3796)
- regsvr32.exe (PID: 8148)
- regsvr32.exe (PID: 5960)
- regsvr32.exe (PID: 5952)
Changes default file association
- reg.exe (PID: 5404)
- reg.exe (PID: 3768)
- reg.exe (PID: 1672)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 7804)
- W7Gadgets.tmp (PID: 5408)
The process hide an interactive prompt from the user
- msiexec.exe (PID: 7984)
The process executes Powershell scripts
- msiexec.exe (PID: 7984)
The process bypasses the loading of PowerShell profile settings
- msiexec.exe (PID: 7984)
Detected use of alternative data streams (AltDS)
- powershell.exe (PID: 6184)
Starts a Microsoft application from unusual location
- DismHost.exe (PID: 6584)
Gets information about processes (POWERSHELL)
- powershell.exe (PID: 6184)
Adds/modifies Windows certificates
- msiexec.exe (PID: 7804)
Starts CMD.EXE for commands execution
- msiexec.exe (PID: 8032)
Creates a new Windows service
- sc.exe (PID: 7540)
- sc.exe (PID: 1272)
- sc.exe (PID: 7816)
Starts SC.EXE for service management
- msiexec.exe (PID: 8032)
The process executes via Task Scheduler
- sidebar.exe (PID: 8180)
Malware-specific behavior (creating "System.dll" in Temp)
- W7Games.exe (PID: 5164)
Uses ATTRIB.EXE to modify file attributes
- W7Gadgets.tmp (PID: 5408)
INFO
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 4408)
- BackgroundTransferHost.exe (PID: 720)
- BackgroundTransferHost.exe (PID: 1348)
- BackgroundTransferHost.exe (PID: 5344)
- BackgroundTransferHost.exe (PID: 1012)
Application launched itself
- chrome.exe (PID: 5064)
- msiexec.exe (PID: 7804)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 4408)
- r8p.exe (PID: 6964)
- msiexec.exe (PID: 7804)
Executable content was dropped or overwritten
- chrome.exe (PID: 5064)
- msiexec.exe (PID: 7804)
Reads the computer name
- r8p.exe (PID: 6964)
- ShellExperienceHost.exe (PID: 1616)
- 7za.exe (PID: 2416)
- 7za.exe (PID: 3024)
- msiexec.exe (PID: 7804)
- msiexec.exe (PID: 7984)
- msiexec.exe (PID: 3020)
- ngen.exe (PID: 3676)
- ngen.exe (PID: 2088)
- ngen.exe (PID: 7284)
- ngen.exe (PID: 3012)
- ngen.exe (PID: 6656)
- ngen.exe (PID: 4268)
- ngen.exe (PID: 6436)
- ngen.exe (PID: 900)
- ngen.exe (PID: 5312)
- ngen.exe (PID: 4180)
- ngen.exe (PID: 1020)
- ngen.exe (PID: 6372)
- ngen.exe (PID: 7688)
- ngen.exe (PID: 7876)
- ngen.exe (PID: 2340)
- ngen.exe (PID: 5972)
- ngen.exe (PID: 4068)
- ngen.exe (PID: 7176)
- ngen.exe (PID: 7432)
- ngen.exe (PID: 7012)
- ngen.exe (PID: 1164)
- ngen.exe (PID: 4812)
- ngen.exe (PID: 968)
- ngen.exe (PID: 3796)
- ngen.exe (PID: 4628)
- ngen.exe (PID: 8184)
- ngen.exe (PID: 7468)
- ngen.exe (PID: 4228)
- ngen.exe (PID: 7520)
- ngen.exe (PID: 7912)
- ngen.exe (PID: 2564)
- SetACL.exe (PID: 3032)
- ngen.exe (PID: 976)
- ngen.exe (PID: 6540)
- SetACL.exe (PID: 4120)
- SetACL.exe (PID: 2568)
- SetACL.exe (PID: 7828)
- SetACL.exe (PID: 6028)
- SetACL.exe (PID: 5132)
- W7Gadgets.tmp (PID: 5408)
- SetACL.exe (PID: 7868)
- sidebar.exe (PID: 4892)
- W7Games.exe (PID: 5164)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 4408)
- r8p.exe (PID: 6964)
- slui.exe (PID: 7808)
Checks supported languages
- r8p.exe (PID: 6964)
- ShellExperienceHost.exe (PID: 1616)
- 7za.exe (PID: 3024)
- 7za.exe (PID: 2416)
- msiexec.exe (PID: 7984)
- msiexec.exe (PID: 7804)
- DismHost.exe (PID: 6584)
- msiexec.exe (PID: 3020)
- ngen.exe (PID: 2088)
- msiexec.exe (PID: 8032)
- ngen.exe (PID: 3676)
- ngen.exe (PID: 3012)
- ngen.exe (PID: 6656)
- ngen.exe (PID: 4268)
- ngen.exe (PID: 1240)
- ngen.exe (PID: 7676)
- ngen.exe (PID: 1020)
- ngen.exe (PID: 900)
- ngen.exe (PID: 5312)
- ngen.exe (PID: 6436)
- ngen.exe (PID: 7472)
- ngen.exe (PID: 4180)
- ngen.exe (PID: 6372)
- ngen.exe (PID: 4068)
- ngen.exe (PID: 2340)
- ngen.exe (PID: 5972)
- ngen.exe (PID: 7876)
- ngen.exe (PID: 7244)
- ngen.exe (PID: 7688)
- ngen.exe (PID: 7176)
- ngen.exe (PID: 7432)
- ngen.exe (PID: 3796)
- ngen.exe (PID: 1164)
- ngen.exe (PID: 4812)
- ngen.exe (PID: 8184)
- ngen.exe (PID: 4228)
- ngen.exe (PID: 7468)
- ngen.exe (PID: 7520)
- ngen.exe (PID: 976)
- ngen.exe (PID: 7012)
- ngen.exe (PID: 4628)
- ngen.exe (PID: 6540)
- ngen.exe (PID: 7912)
- ngen.exe (PID: 2564)
- SetACL.exe (PID: 3032)
- SetACL.exe (PID: 4120)
- SetACL.exe (PID: 7828)
- SetACL.exe (PID: 6028)
- SetACL.exe (PID: 7868)
- SetACL.exe (PID: 2568)
- W7Gadgets.exe (PID: 4284)
- SetACL.exe (PID: 5132)
- W7Gadgets.tmp (PID: 5408)
- sidebar.exe (PID: 4892)
- W7Games.exe (PID: 5164)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 4408)
- slui.exe (PID: 8040)
- r8p.exe (PID: 6964)
- slui.exe (PID: 7808)
- msiexec.exe (PID: 7804)
Detects AutoHotkey samples (YARA)
- r8p.exe (PID: 6964)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 7724)
- powershell.exe (PID: 6816)
- powershell.exe (PID: 5132)
- powershell.exe (PID: 2040)
- powershell.exe (PID: 6184)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 7724)
- powershell.exe (PID: 5132)
- powershell.exe (PID: 2040)
Create files in a temporary directory
- r8p.exe (PID: 6964)
- msiexec.exe (PID: 7804)
- DismHost.exe (PID: 6584)
- msiexec.exe (PID: 3020)
- W7Gadgets.exe (PID: 4284)
- W7Gadgets.tmp (PID: 5408)
The sample compiled with arabic language support
- 7za.exe (PID: 2416)
The sample compiled with bulgarian language support
- 7za.exe (PID: 2416)
The sample compiled with german language support
- 7za.exe (PID: 2416)
The sample compiled with czech language support
- 7za.exe (PID: 2416)
The sample compiled with spanish language support
- 7za.exe (PID: 2416)
The sample compiled with english language support
- 7za.exe (PID: 2416)
- r8p.exe (PID: 6964)
- powershell.exe (PID: 6184)
- msiexec.exe (PID: 7804)
- W7Gadgets.tmp (PID: 5408)
- W7Games.exe (PID: 5164)
The sample compiled with french language support
- 7za.exe (PID: 2416)
The sample compiled with japanese language support
- 7za.exe (PID: 2416)
The sample compiled with korean language support
- 7za.exe (PID: 2416)
The sample compiled with polish language support
- 7za.exe (PID: 2416)
The sample compiled with Italian language support
- 7za.exe (PID: 2416)
The sample compiled with swedish language support
- 7za.exe (PID: 2416)
The sample compiled with chinese language support
- 7za.exe (PID: 2416)
The sample compiled with turkish language support
- 7za.exe (PID: 2416)
Creates files in the program directory
- r8p.exe (PID: 6964)
- DismHost.exe (PID: 6584)
- W7Gadgets.tmp (PID: 5408)
- W7Games.exe (PID: 5164)
The sample compiled with portuguese language support
- 7za.exe (PID: 2416)
The sample compiled with russian language support
- 7za.exe (PID: 2416)
The sample compiled with slovak language support
- 7za.exe (PID: 2416)
Reads the machine GUID from the registry
- r8p.exe (PID: 6964)
- DismHost.exe (PID: 6584)
- msiexec.exe (PID: 7804)
- msiexec.exe (PID: 8032)
The executable file from the user directory is run by the Powershell process
- DismHost.exe (PID: 6584)
Reads Environment values
- DismHost.exe (PID: 6584)
NGen native .NET image generation
- ngen.exe (PID: 3676)
- ngen.exe (PID: 2088)
- ngen.exe (PID: 3300)
- ngen.exe (PID: 7184)
- ngen.exe (PID: 8128)
- ngen.exe (PID: 6656)
- ngen.exe (PID: 3012)
- ngen.exe (PID: 1812)
- ngen.exe (PID: 4268)
- ngen.exe (PID: 1240)
- ngen.exe (PID: 7676)
- ngen.exe (PID: 7284)
- ngen.exe (PID: 900)
- ngen.exe (PID: 7472)
- ngen.exe (PID: 6436)
- ngen.exe (PID: 5312)
- ngen.exe (PID: 5112)
- ngen.exe (PID: 4180)
- ngen.exe (PID: 7688)
- ngen.exe (PID: 1020)
- ngen.exe (PID: 6372)
- ngen.exe (PID: 2340)
- ngen.exe (PID: 5972)
- ngen.exe (PID: 7876)
- ngen.exe (PID: 4068)
- ngen.exe (PID: 7244)
- ngen.exe (PID: 7432)
- ngen.exe (PID: 3796)
- ngen.exe (PID: 4812)
- ngen.exe (PID: 1164)
- ngen.exe (PID: 968)
- ngen.exe (PID: 7012)
- ngen.exe (PID: 7176)
- ngen.exe (PID: 4628)
- ngen.exe (PID: 8184)
- ngen.exe (PID: 7468)
- ngen.exe (PID: 4228)
- ngen.exe (PID: 976)
- ngen.exe (PID: 7520)
- ngen.exe (PID: 7912)
- ngen.exe (PID: 7888)
- ngen.exe (PID: 2564)
- ngen.exe (PID: 6540)
Write to the desktop.ini file (may be used to cloak folders)
- msiexec.exe (PID: 7804)
Creates a software uninstall entry
- msiexec.exe (PID: 7804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
481
Monitored processes
331
Malicious processes
14
Suspicious processes
12
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 132 | "C:\WINDOWS\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\OCURDiscovery" /xml "C:\Program Files\Windows Media Center\tasks\OCURDiscovery.xml" /f | C:\Windows\System32\schtasks.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 208 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SetACL.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 616 | "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SYSTEM\CurrentControlSet\Services\ADOVMPPackage" -ot reg -actn setowner -ownr "n:S-1-5-32-544;s:y" -rec yes | C:\Program Files\Windows Media Center\SetACL.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Helge Klein Integrity Level: SYSTEM Description: SetACL 3 Exit code: 0 Version: 3.0.6.0 Modules
| |||||||||||||||
| 644 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SetACL.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 668 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 684 | reg import "C:\Windows\Revert8Plus\Registry\sib-vista.reg" | C:\Windows\System32\reg.exe | — | r8p.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 684 | "C:\WINDOWS\System32\cmd.exe" /c mklink /h "C:\WINDOWS\Microsoft.NET\assembly\GAC_64\mcstoredb\v4.0_6.3.0.0__31bf3856ad364e35\mcstoredb.dll" "C:\Program Files\Windows Media Center\ehome\mcstoredb.dll" | C:\Windows\System32\cmd.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 720 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 812 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | ngen.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 856 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
53 018
Read events
49 413
Write events
3 570
Delete events
35
Modification events
| (PID) Process: | (5064) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (5064) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (5064) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (5064) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (5064) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (720) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (720) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (720) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4408) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4408) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
690
Suspicious files
473
Text files
2 040
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c287.TMP | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c287.TMP | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c287.TMP | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c287.TMP | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c296.TMP | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c296.TMP | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 5064 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
46
DNS requests
38
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4408 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7724 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6676 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6964 | r8p.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd | unknown | — | — | whitelisted |
6964 | r8p.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D | unknown | — | — | whitelisted |
6676 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6964 | r8p.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1 | unknown | — | — | whitelisted |
6964 | r8p.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | unknown | — | — | whitelisted |
7804 | msiexec.exe | GET | 200 | 2.16.164.49:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6652 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5064 | chrome.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
7232 | chrome.exe | 140.82.121.4:80 | github.com | GITHUB | US | whitelisted |
7232 | chrome.exe | 140.82.121.4:443 | github.com | GITHUB | US | whitelisted |
7232 | chrome.exe | 74.125.133.84:443 | accounts.google.com | GOOGLE | US | whitelisted |
7232 | chrome.exe | 185.199.108.133:443 | objects.githubusercontent.com | FASTLY | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
github.com |
| whitelisted |
accounts.google.com |
| whitelisted |
objects.githubusercontent.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.google.com |
| whitelisted |
arc.msn.com |
| whitelisted |