File name:

bootstrap.exe

Full analysis: https://app.any.run/tasks/139313c2-8035-4c66-9d8f-ea42cb8fa231
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 08, 2024, 20:51:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
pastebin
xworm
remote
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

6FE0A3EB770D48E66BEA141BBDE1B009

SHA1:

00BE3E1B6965EDF1D1ED992201DA02BDB74A5771

SHA256:

16032ABC73B4CFF985D5F7BD450C732BC39A9104DB727E66C92C0D5565F78F0B

SSDEEP:

1536:dcM1Lwd6/4BNP0BY/0qL0eYf4l2bZVU8pOOSzXCE7AZ/OZzEvv9ngg35VRBtspVF:U5f4fnbZVw3cZOZzExg8aIL34LX9r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • bootstrap.exe (PID: 6384)

    • Changes the autorun value in the registry

      • bootstrap.exe (PID: 6384)

    • Create files in the Startup directory

      • bootstrap.exe (PID: 6384)

    • XWORM has been detected (YARA)

      • bootstrap.exe (PID: 6384)

    • XWORM has been detected (SURICATA)

      • bootstrap.exe (PID: 6384)

    • Connects to the CnC server

      • bootstrap.exe (PID: 6384)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • bootstrap.exe (PID: 6384)

    • Reads security settings of Internet Explorer

      • bootstrap.exe (PID: 6384)

    • Reads the date of Windows installation

      • bootstrap.exe (PID: 6384)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • bootstrap.exe (PID: 6384)

    • Contacting a server suspected of hosting an CnC

      • bootstrap.exe (PID: 6384)

    • Creates files like ransomware instruction

      • bootstrap.exe (PID: 6384)

    • The process executes via Task Scheduler

      • bootstrap.exe (PID: 6256)

    • Connects to unusual port

      • bootstrap.exe (PID: 6384)

  • INFO

    • Checks supported languages

      • bootstrap.exe (PID: 6384)
      • identity_helper.exe (PID: 7412)
      • identity_helper.exe (PID: 7464)
      • bootstrap.exe (PID: 6256)

    • Reads the computer name

      • bootstrap.exe (PID: 6384)
      • identity_helper.exe (PID: 7464)
      • identity_helper.exe (PID: 7412)
      • bootstrap.exe (PID: 6256)

    • Reads the machine GUID from the registry

      • bootstrap.exe (PID: 6384)
      • bootstrap.exe (PID: 6256)

    • Reads Environment values

      • bootstrap.exe (PID: 6384)
      • identity_helper.exe (PID: 7464)
      • identity_helper.exe (PID: 7412)

    • Process checks computer location settings

      • bootstrap.exe (PID: 6384)

    • Checks proxy server information

      • bootstrap.exe (PID: 6384)

    • Disables trace logs

      • bootstrap.exe (PID: 6384)

    • Creates files or folders in the user directory

      • bootstrap.exe (PID: 6384)

    • Reads the software policy settings

      • bootstrap.exe (PID: 6384)

    • Create files in a temporary directory

      • bootstrap.exe (PID: 6384)

    • Reads Microsoft Office registry keys

      • bootstrap.exe (PID: 6384)
      • msedge.exe (PID: 6252)
      • msedge.exe (PID: 7816)

    • Application launched itself

      • msedge.exe (PID: 6252)
      • msedge.exe (PID: 7816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6384) bootstrap.exe
C2https://pastebin.com/raw/X4Zf0q6k:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.2
USB drop nameUSB.exe
MutexTdJvcsYQq52Lbai3
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:07 09:03:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 82432
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0x1609e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: bootstrap.exe
LegalCopyright:
OriginalFileName: bootstrap.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
38
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XWORM bootstrap.exe svchost.exe schtasks.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bootstrap.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x31c,0x320,0x324,0x314,0x32c,0x7fffd4165fd8,0x7fffd4165fe4,0x7fffd4165ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3704 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4080 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5944"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3540 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6252"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\admin\Desktop\How To Decrypt My Files.htmlC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
bootstrap.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6256"C:\Users\admin\AppData\Local\Temp\bootstrap.exe"C:\Users\admin\AppData\Local\Temp\bootstrap.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrap.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6276"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2660 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6384"C:\Users\admin\AppData\Local\Temp\bootstrap.exe" C:\Users\admin\AppData\Local\Temp\bootstrap.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrap.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(6384) bootstrap.exe
C2https://pastebin.com/raw/X4Zf0q6k:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.2
USB drop nameUSB.exe
MutexTdJvcsYQq52Lbai3
6416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2364 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
17 787
Read events
17 653
Write events
130
Delete events
4

Modification events

(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
138
Text files
73
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384bootstrap.exeC:\Users\admin\NTUSER.DAT.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\ntuser.dat.LOG1.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\Desktop\assistanceanything.jpg.ENCbinary
MD5:760788265079B4F5697C20188677FF31
SHA256:4FD419322C94BC27EFFAB07047D44CAD0EE93310A7567B92401C824F7F39D514
6384bootstrap.exeC:\Users\admin\Desktop\completeemployees.rtf.ENCbinary
MD5:DCB2110F2D6B112570BA56BF78D6CD4F
SHA256:493C7C31C9A9994A94C66B5B9550E4875A705A613982D10DEBF6418937D8BCF3
6384bootstrap.exeC:\Users\admin\Desktop\beingthursday.rtf.ENCbinary
MD5:BF5FFFB3B050D9DE2769FD0C60152135
SHA256:398E3F5777C2BAC48AF2619CC5BFDE3803BF2140B533BEA7E64BCE6DF5892366
6384bootstrap.exeC:\Users\admin\Desktop\kidsbig.png.ENCbinary
MD5:3D43854E8FB591B3735E6F7BED47B6D7
SHA256:0E28B783531DAFB6619B25C63DAC746526B65B24C88D7BCF5B0B5EBBFE82CC2D
6384bootstrap.exeC:\Users\admin\Desktop\entertainmentchris.jpg.ENCbinary
MD5:5F89271A3208D7C35BDFD6454B9DA727
SHA256:3F0AC243565972EC16C9B2724709ACA765020B7FC71AD8EB236AC0AE88D76B47
6384bootstrap.exeC:\Users\admin\Desktop\peterfund.rtf.ENCbinary
MD5:5578C4DDE7577C257B44B6844DB33F52
SHA256:CC94148DCDC30848479CDDE04F96E103D33FB860435FBC7C25151C19E2C14EE1
6384bootstrap.exeC:\Users\admin\Desktop\springmaps.rtf.ENCbinary
MD5:B5D843CBC70BB6FCCC4A87D9CE33F5B1
SHA256:C94C615141961A9D4E1C00B0712B4E2AA5C5E84D2FF411D4BF27DA86FB117BB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
61
DNS requests
41
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6384
bootstrap.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5976
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7116
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7088
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4064
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2680
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6384
bootstrap.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6384
bootstrap.exe
104.20.3.235:443
pastebin.com
CLOUDFLARENET
—
unknown
5336
SearchApp.exe
104.126.37.179:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
ip-api.com
  • 208.95.112.1
shared
pastebin.com
  • 104.20.3.235
  • 104.20.4.235
  • 172.67.19.24
shared
authority-keeping.gl.at.ply.gg
  • 147.185.221.18
unknown
www.bing.com
  • 104.126.37.179
  • 104.126.37.177
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.128
  • 104.126.37.162
  • 104.126.37.163
  • 104.126.37.161
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.130
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.140
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 104.126.37.179
  • 104.126.37.153
  • 104.126.37.160
  • 104.126.37.123
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.144
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6384
bootstrap.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6384
bootstrap.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2256
svchost.exe
Misc activity
ET INFO Tunneling Service in DNS Lookup (* .ply .gg)
2256
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
6384
bootstrap.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
12 ETPRO signatures available at the full report
Process
Message
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bootstrap.exe