File name:

bootstrap.exe

Full analysis: https://app.any.run/tasks/139313c2-8035-4c66-9d8f-ea42cb8fa231
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 08, 2024, 20:51:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
pastebin
xworm
remote
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

6FE0A3EB770D48E66BEA141BBDE1B009

SHA1:

00BE3E1B6965EDF1D1ED992201DA02BDB74A5771

SHA256:

16032ABC73B4CFF985D5F7BD450C732BC39A9104DB727E66C92C0D5565F78F0B

SSDEEP:

1536:dcM1Lwd6/4BNP0BY/0qL0eYf4l2bZVU8pOOSzXCE7AZ/OZzEvv9ngg35VRBtspVF:U5f4fnbZVw3cZOZzExg8aIL34LX9r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • bootstrap.exe (PID: 6384)

    • Changes the autorun value in the registry

      • bootstrap.exe (PID: 6384)

    • Create files in the Startup directory

      • bootstrap.exe (PID: 6384)

    • XWORM has been detected (YARA)

      • bootstrap.exe (PID: 6384)

    • Connects to the CnC server

      • bootstrap.exe (PID: 6384)

    • XWORM has been detected (SURICATA)

      • bootstrap.exe (PID: 6384)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • bootstrap.exe (PID: 6384)

    • Reads security settings of Internet Explorer

      • bootstrap.exe (PID: 6384)

    • Reads the date of Windows installation

      • bootstrap.exe (PID: 6384)

    • Creates files like ransomware instruction

      • bootstrap.exe (PID: 6384)

    • Connects to unusual port

      • bootstrap.exe (PID: 6384)

    • The process executes via Task Scheduler

      • bootstrap.exe (PID: 6256)

    • Checks for external IP

      • bootstrap.exe (PID: 6384)
      • svchost.exe (PID: 2256)

    • Contacting a server suspected of hosting an CnC

      • bootstrap.exe (PID: 6384)

  • INFO

    • Checks supported languages

      • bootstrap.exe (PID: 6384)
      • identity_helper.exe (PID: 7464)
      • identity_helper.exe (PID: 7412)
      • bootstrap.exe (PID: 6256)

    • Disables trace logs

      • bootstrap.exe (PID: 6384)

    • Reads the computer name

      • bootstrap.exe (PID: 6384)
      • identity_helper.exe (PID: 7464)
      • bootstrap.exe (PID: 6256)
      • identity_helper.exe (PID: 7412)

    • Reads Environment values

      • bootstrap.exe (PID: 6384)
      • identity_helper.exe (PID: 7464)
      • identity_helper.exe (PID: 7412)

    • Checks proxy server information

      • bootstrap.exe (PID: 6384)

    • Reads the machine GUID from the registry

      • bootstrap.exe (PID: 6384)
      • bootstrap.exe (PID: 6256)

    • Process checks computer location settings

      • bootstrap.exe (PID: 6384)

    • Creates files or folders in the user directory

      • bootstrap.exe (PID: 6384)

    • Reads the software policy settings

      • bootstrap.exe (PID: 6384)

    • Create files in a temporary directory

      • bootstrap.exe (PID: 6384)

    • Application launched itself

      • msedge.exe (PID: 6252)
      • msedge.exe (PID: 7816)

    • Reads Microsoft Office registry keys

      • bootstrap.exe (PID: 6384)
      • msedge.exe (PID: 6252)
      • msedge.exe (PID: 7816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6384) bootstrap.exe
C2https://pastebin.com/raw/X4Zf0q6k:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.2
USB drop nameUSB.exe
MutexTdJvcsYQq52Lbai3
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:07 09:03:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 82432
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0x1609e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: bootstrap.exe
LegalCopyright:
OriginalFileName: bootstrap.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
38
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XWORM bootstrap.exe svchost.exe schtasks.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bootstrap.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x31c,0x320,0x324,0x314,0x32c,0x7fffd4165fd8,0x7fffd4165fe4,0x7fffd4165ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3704 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4080 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5944"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3540 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6252"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\admin\Desktop\How To Decrypt My Files.htmlC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
bootstrap.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6256"C:\Users\admin\AppData\Local\Temp\bootstrap.exe"C:\Users\admin\AppData\Local\Temp\bootstrap.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrap.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6276"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2660 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6384"C:\Users\admin\AppData\Local\Temp\bootstrap.exe" C:\Users\admin\AppData\Local\Temp\bootstrap.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrap.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(6384) bootstrap.exe
C2https://pastebin.com/raw/X4Zf0q6k:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.2
USB drop nameUSB.exe
MutexTdJvcsYQq52Lbai3
6416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2364 --field-trial-handle=2504,i,13253363113670155601,9980505530356056160,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
17 787
Read events
17 653
Write events
130
Delete events
4

Modification events

(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6384) bootstrap.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bootstrap_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
138
Text files
73
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384bootstrap.exeC:\Users\admin\ntuser.dat.LOG2.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\Contacts\desktop.ini.ENCbinary
MD5:B1CC23AC28962E3A0D6A2E43E4ABB7B8
SHA256:C2DFDFC4AFC71309B23DB582648725973D67C6489F6F1B5F3ACFAE1305C8AE01
6384bootstrap.exeC:\Users\admin\3D Objects\desktop.ini.ENCbinary
MD5:A930EEA0050BE8113202B92871538BC5
SHA256:B52023AFAC778420233EB8A64E2269BBA71022E04883CC9C1FB6E36F540B51C7
6384bootstrap.exeC:\Users\admin\ntuser.ini.ENCbinary
MD5:F91C79D335DF0EAE70CA37283B85EB35
SHA256:032598CB2FD235F845DB3C75A431F82F2AE7559CD6A798193F7199FDE6ABCDA0
6384bootstrap.exeC:\Users\admin\ntuser.dat.LOG1.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\Desktop\beingthursday.rtf.ENCbinary
MD5:BF5FFFB3B050D9DE2769FD0C60152135
SHA256:398E3F5777C2BAC48AF2619CC5BFDE3803BF2140B533BEA7E64BCE6DF5892366
6384bootstrap.exeC:\Users\admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms.ENCtext
MD5:CE101E81F0E1F10C4F5B2C5472CD01E0
SHA256:C5642213AFD81B0DC400783EB0EF7FFDF55EBBDCA38BEB06583600910472FA07
6384bootstrap.exeC:\Users\admin\Desktop\basedsummer.rtf.ENCbinary
MD5:AF3EBC9E1AA3E108B6E9B21FD2160947
SHA256:2EA9D9C951B30B00A04778CD2584C4B0E19E545389E55F14B0C2F8A0DBC09B1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
61
DNS requests
41
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6384
bootstrap.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
5976
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7088
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7116
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4064
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2680
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6384
bootstrap.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6384
bootstrap.exe
104.20.3.235:443
pastebin.com
CLOUDFLARENET
—
unknown
5336
SearchApp.exe
104.126.37.179:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
ip-api.com
  • 208.95.112.1
shared
pastebin.com
  • 104.20.3.235
  • 104.20.4.235
  • 172.67.19.24
shared
authority-keeping.gl.at.ply.gg
  • 147.185.221.18
unknown
www.bing.com
  • 104.126.37.179
  • 104.126.37.177
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.128
  • 104.126.37.162
  • 104.126.37.163
  • 104.126.37.161
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.130
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.140
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 104.126.37.179
  • 104.126.37.153
  • 104.126.37.160
  • 104.126.37.123
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.144
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6384
bootstrap.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6384
bootstrap.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2256
svchost.exe
Misc activity
ET INFO Tunneling Service in DNS Lookup (* .ply .gg)
2256
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
6384
bootstrap.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
12 ETPRO signatures available at the full report
Process
Message
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
bootstrap.exe
Conversion from string "" to type 'Integer' is not valid.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bootstrap.exe