File name:

Bootstrapper.exe

Full analysis: https://app.any.run/tasks/7df7b157-af8e-4bfd-b44f-e2354e8b225a
Verdict: Malicious activity
Analysis date: June 18, 2025, 14:58:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

47DF55B41415EED48A86ED3BD98BF9B3

SHA1:

ECB61DCC9C479633833F0C71762C1B66FC0C9E0E

SHA256:

338E9707EE449412BC9E17A80DB6F3DE0D765A5160270044A604FC287C0E9E79

SSDEEP:

49152:Fjh77p31TdI+/NtDNSqIkeCevgt0u+wQkkusbRmNdJchDCWDwClZXoskQNf9uTPi:Rh77p3f/NNNSqvkgt0uwkkutmDCqwCld

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Bootstrapper.exe (PID: 3640)

  • SUSPICIOUS

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1156)

    • Get information on the list of running processes

      • cmd.exe (PID: 1156)

    • Executing commands from a ".bat" file

      • Bootstrapper.exe (PID: 3640)

    • Starts CMD.EXE for commands execution

      • Bootstrapper.exe (PID: 3640)

    • Reads security settings of Internet Explorer

      • Bootstrapper.exe (PID: 3640)

    • The executable file from the user directory is run by the CMD process

      • Amendments.com (PID: 6876)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 1156)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1156)

    • There is functionality for taking screenshot (YARA)

      • Bootstrapper.exe (PID: 3640)

    • Executes application which crashes

      • Amendments.com (PID: 6876)

  • INFO

    • Reads the computer name

      • extrac32.exe (PID: 1216)
      • Bootstrapper.exe (PID: 3640)
      • Amendments.com (PID: 6876)

    • Create files in a temporary directory

      • extrac32.exe (PID: 1216)

    • Process checks computer location settings

      • Bootstrapper.exe (PID: 3640)

    • Checks supported languages

      • extrac32.exe (PID: 1216)
      • Amendments.com (PID: 6876)
      • Bootstrapper.exe (PID: 3640)

    • Reads mouse settings

      • Amendments.com (PID: 6876)

    • Manual execution by a user

      • OOBE-Maintenance.exe (PID: 5008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bootstrapper.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs amendments.com choice.exe no specs slui.exe no specs oobe-maintenance.exe conhost.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\WINDOWS\system32\cmd.exe" /c copy Submit.wpd Submit.wpd.bat & Submit.wpd.batC:\Windows\SysWOW64\cmd.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1200findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1216extrac32 /Y Wang.wpd *.*C:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1564findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—OOBE-Maintenance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3640"C:\Users\admin\AppData\Local\Temp\Bootstrapper.exe" C:\Users\admin\AppData\Local\Temp\Bootstrapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3768tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4868findstr /V "Stationery" Subsidiaries C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4916tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
1 754
Read events
1 754
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
24
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Has.wpdbinary
MD5:4075D11B782D1707557C8C0D84ECA07E
SHA256:40846E35BB6A272A268D8AC63152205E21E379C3ACEF10BA672149F5F70784C7
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Cancelled.wpdbinary
MD5:6779F03570107ECDFCB2261255359828
SHA256:E405BBEEF756A666C2FC13591F1A84330A343CD91DB37A19C9EEE903A567E650
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Uniform.wpdbinary
MD5:EB25D85FADA45A75B6CF95A38B84F7C6
SHA256:B8750411F49B48121F2BAA13DFE4FD9535929F3C8758131DF01CC63FD48FC026
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Af.wpdbinary
MD5:CB4352C68C5F365D91FD8F71F0301174
SHA256:F59FFC34BA6ACA5F4CE6BAD5952D2F46E1628CA6E1399373439C82041A902743
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Jesus.wpdbinary
MD5:628D35A727CA4E26DE3A94DF59B2BB5D
SHA256:777AEFDD47EE78CD7DE1BD3E599785721455A80DE941B33C210017253594469C
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Witch.wpdbinary
MD5:3025EDCCCE36B10653ECBB5A9838D41A
SHA256:864696129FA1318A6BAD9C54726F9874DFF8DD645C912471A08FCB39EFBF6968
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Submit.wpdtext
MD5:3CA61D72A1A4259022B15E6172DFEF4C
SHA256:D754840CDDF63F018588B34ACC6E265E697A2361ADAC2816831A4B6D3AA629AA
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Victorian.wpdbinary
MD5:9B630C28BD930F7441E7D8B9D98937AD
SHA256:BDB0D3AFD6622A0BA7B98C0308466D195C2629FA759B8BAFD395F6318FCF13A3
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Campaigns.wpdbinary
MD5:E1547267E54F6EC473B573E0E6C9F3AB
SHA256:A7B4E11CA80FC00E1091A2701764FD20E080177759F3B776AB72515527698DE4
3640Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Lifetime.wpdbinary
MD5:4B5A1080870348F7A0685CBA15A3DD88
SHA256:AB9D44E3B778163529A30A3664774FF3D7878E4019B669D62CDD212FCE6D0684
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
FR
binary
825 b
whitelisted
3652
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
868 b
whitelisted
3652
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
420 b
whitelisted
7020
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2368
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7020
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7020
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
IEzOGcVbmoYenILqWOrDtkfJMEdh.IEzOGcVbmoYenILqWOrDtkfJMEdh
  • —
unknown
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.128
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.18.121.147
  • 2.18.121.139
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bootstrapper.exe