File name:

BootstrapperNew(2).exe

Full analysis: https://app.any.run/tasks/f06350e3-e63e-4c69-b1b8-2c5ea9e520f2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 04, 2025, 17:24:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

1974506038C5934399DE3C2F6C7544DE

SHA1:

2178C758DE77C465014F96262CAA4059BA7D996E

SHA256:

5BCC68604C4C4ADD6D592E0455156024E52FF10F9F06DAA1F543B005D7C2A53F

SSDEEP:

98304:bYzoojJRba+nPSqNCrRasNk0LW4kr+zIIvt4Fi1VG86jieQEnW/T/2iGgr2YCQeK:U+oMW6If

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • Solara.exe (PID: 8024)

    • Process drops legitimate windows executable

      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1472)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 5048)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 1472)
      • MicrosoftEdgeUpdate.exe (PID: 5048)

    • Executable content was dropped or overwritten

      • MicrosoftEdgeWebview2Setup.exe (PID: 1472)
      • BootstrapperNew(2).exe (PID: 7496)

    • Process requests binary or script from the Internet

      • BootstrapperNew(2).exe (PID: 7496)

    • Reads the date of Windows installation

      • BootstrapperNew(2).exe (PID: 7496)

    • The process drops C-runtime libraries

      • BootstrapperNew(2).exe (PID: 7496)

    • Executes application which crashes

      • Solara.exe (PID: 8024)

    • Reads the BIOS version

      • Solara.exe (PID: 8024)

  • INFO

    • Checks supported languages

      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1472)
      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • Solara.exe (PID: 8024)
      • identity_helper.exe (PID: 1804)
      • identity_helper.exe (PID: 736)

    • Creates files in the program directory

      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1472)

    • Reads the computer name

      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • Solara.exe (PID: 8024)
      • identity_helper.exe (PID: 1804)
      • identity_helper.exe (PID: 736)

    • Reads the machine GUID from the registry

      • BootstrapperNew(2).exe (PID: 7496)
      • Solara.exe (PID: 8024)

    • Disables trace logs

      • BootstrapperNew(2).exe (PID: 7496)
      • Solara.exe (PID: 8024)

    • Checks proxy server information

      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • wermgr.exe (PID: 7444)
      • Solara.exe (PID: 8024)

    • Reads Environment values

      • BootstrapperNew(2).exe (PID: 7496)
      • Solara.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • identity_helper.exe (PID: 1804)
      • identity_helper.exe (PID: 736)

    • Create files in a temporary directory

      • BootstrapperNew(2).exe (PID: 7496)

    • The sample compiled with english language support

      • MicrosoftEdgeUpdate.exe (PID: 5048)
      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1472)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • BootstrapperNew(2).exe (PID: 7496)

    • Reads the software policy settings

      • BootstrapperNew(2).exe (PID: 7496)
      • wermgr.exe (PID: 7444)
      • Solara.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 5048)

    • Process checks computer location settings

      • BootstrapperNew(2).exe (PID: 7496)
      • MicrosoftEdgeUpdate.exe (PID: 5048)

    • Application launched itself

      • msedge.exe (PID: 5604)
      • msedge.exe (PID: 7436)
      • msedge.exe (PID: 6156)

    • Manual execution by a user

      • msedge.exe (PID: 7436)

    • Process checks whether UAC notifications are on

      • Solara.exe (PID: 8024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2056:07:11 06:55:49+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 6879232
InitializedDataSize: 9216
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Bootstrapper
FileVersion: 1.0.0.0
InternalName: Bootstrapper.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: Bootstrapper.exe
ProductName: Bootstrapper
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
57
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bootstrappernew(2).exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe solara.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs werfault.exe no specs bootstrappernew(2).exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5564 --field-trial-handle=2376,i,303671788504931190,15896662431766179177,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4960 --field-trial-handle=2376,i,303671788504931190,15896662431766179177,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1472"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
BootstrapperNew(2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.61
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1512"C:\Users\admin\AppData\Local\Temp\BootstrapperNew(2).exe" C:\Users\admin\AppData\Local\Temp\BootstrapperNew(2).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bootstrapper
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrappernew(2).exe
c:\windows\system32\ntdll.dll
1512"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2448 --field-trial-handle=2388,i,15370591713768381863,1234734168100201597,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6492 --field-trial-handle=2388,i,15370591713768381863,1234734168100201597,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1804"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5960 --field-trial-handle=2388,i,15370591713768381863,1234734168100201597,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2092"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6612 --field-trial-handle=2388,i,15370591713768381863,1234734168100201597,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2148"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5644 --field-trial-handle=2388,i,15370591713768381863,1234734168100201597,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4328 --field-trial-handle=2388,i,15370591713768381863,1234734168100201597,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 687
Read events
21 565
Write events
117
Delete events
5

Modification events

(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7496) BootstrapperNew(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperNew(2)_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
211
Suspicious files
368
Text files
66
Unknown types
31

Dropped files

PID
Process
Filename
Type
1472MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU34F3.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:B552E2C44C71C93E4AAE5411357BDE40
SHA256:C6EA70D4372A37A6EE06B35C1F6E1B2668B39005FC2D71347BF6FD3BF680B316
1472MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU34F3.tmp\psuser_arm64.dllexecutable
MD5:0A9E22D7E11B698C3665F5F0B53F1E49
SHA256:CCA43D97C1AE15B54C10B778670044A6EE413C4545D9DC554CCCB527FBF3DFEE
7496BootstrapperNew(2).exeC:\Users\admin\AppData\Local\Temp\CONFIGbinary
MD5:0284FA0391784125AD3B12BE8C92C6AE
SHA256:789075B8C810F2B63F86DD1F8B7BE836178AC679A32F2CB2376E013BC78C68C0
7496BootstrapperNew(2).exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hf3sp3gd.3kl.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1472MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU34F3.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:570D4E78E4EF679C9435247685F8A8D3
SHA256:5CDF1C3C7F72120CA88145D38E48C9E1E6A6BD4EF43021193FD76D98D2F05496
1472MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU34F3.tmp\msedgeupdate.dllexecutable
MD5:750D6630199F17068FF1CE9F2F351DD8
SHA256:36BBE422572AA67CD61CB6ACCFC0D68A8FCD32D72405B504C2FF576BEDB8E35C
7496BootstrapperNew(2).exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_garhc344.2nq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1472MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU34F3.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:D65C7E1B579CD5ABA05D65D5FF0002AD
SHA256:5F2A785AEA8F1EAFD0B473722C95B1178A684734DA79BE28D3A445470F810062
7496BootstrapperNew(2).exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:5424BAC02DB3D21E75C21FF2049CD04F
SHA256:3C60FDBD71B468CF52FDE6F780740A910C9D190E7023B1AC1217D427D794CCB1
1472MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU34F3.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:7AE279F8F5FC1A139FC3FA06BF28BC59
SHA256:9E259500EBA6A26384161A28A92F2DEDBDD6B1073DE46D8FEC74E03762E031D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
73
DNS requests
62
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
868 b
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
7444
wermgr.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
7444
wermgr.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
868 b
whitelisted
756
lsass.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
7384
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
756
lsass.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/r4.crl
US
binary
530 b
whitelisted
7384
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
7496
BootstrapperNew(2).exe
GET
301
104.21.93.27:80
http://getsolara.dev/api/endpoint.json
unknown
html
167 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4452
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7872
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.153
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.132
  • 20.190.160.130
  • 20.190.160.2
  • 40.126.32.74
  • 20.190.160.67
  • 20.190.160.64
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 2.16.168.217
  • 2.16.168.212
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BootstrapperNew(2).exe