File name:

Bootstrapper.zip

Full analysis: https://app.any.run/tasks/9ff9f5f4-1d30-4c1c-a94d-72681d850217
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 02, 2025, 17:19:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
sliverfox
arch-exec
github
crypto-regex
golang
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

9BA94AC44294258328B5B23E6FBCAF4A

SHA1:

3EF50DA71C5800F02680733B184BB11BB0CA309B

SHA256:

A9E76B770FB8A61F793A61CA6701E1F76EA95282D5A3647D8DFCCF1B560F401A

SSDEEP:

98304:T8WkMQF7kSEqTrIiukIw2MyLx3CyMpLlFq/uZvFVdcm6MjF0lES3WNm6IUG6Qz3i:17HJ3NE43TU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6320)

    • SLIVERFOX has been found (auto)

      • WinRAR.exe (PID: 6320)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 4556)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 5712)

    • Scans artifacts that could help determine the target

      • msedgewebview2.exe (PID: 2212)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6320)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • msedgewebview2.exe (PID: 2212)

    • Executable content was dropped or overwritten

      • Bootstrapper.exe (PID: 6784)
      • Luna.exe (PID: 6948)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2928)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • setup.exe (PID: 3140)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 2736)

    • Found regular expressions for crypto-addresses (YARA)

      • Luna.exe (PID: 6880)
      • Luna.exe (PID: 6948)

    • Process drops legitimate windows executable

      • Luna.exe (PID: 6948)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2928)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 2736)
      • setup.exe (PID: 3140)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 2928)
      • MicrosoftEdgeUpdate.exe (PID: 4556)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 4556)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5748)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6200)
      • MicrosoftEdgeUpdate.exe (PID: 5244)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5036)

    • Application launched itself

      • Luna.exe (PID: 6880)
      • setup.exe (PID: 3140)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • msedgewebview2.exe (PID: 2212)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 6860)

    • Creates a software uninstall entry

      • setup.exe (PID: 3140)

    • Searches for installed software

      • setup.exe (PID: 3140)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6320)

    • Reads Environment values

      • Luna.exe (PID: 6948)
      • Luna.exe (PID: 6880)
      • MicrosoftEdgeUpdate.exe (PID: 6692)
      • MicrosoftEdgeUpdate.exe (PID: 4120)
      • msedgewebview2.exe (PID: 2212)

    • Reads the software policy settings

      • Bootstrapper.exe (PID: 6784)
      • Luna.exe (PID: 6948)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • Luna.exe (PID: 6880)
      • MicrosoftEdgeUpdate.exe (PID: 6692)
      • MicrosoftEdgeUpdate.exe (PID: 4120)

    • Reads the computer name

      • Bootstrapper.exe (PID: 6784)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdate.exe (PID: 5244)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6200)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5036)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5748)
      • MicrosoftEdgeUpdate.exe (PID: 1380)
      • MicrosoftEdgeUpdate.exe (PID: 6692)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • Luna.exe (PID: 6948)
      • Luna.exe (PID: 6880)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 2736)
      • setup.exe (PID: 3140)
      • MicrosoftEdgeUpdate.exe (PID: 4120)
      • msedgewebview2.exe (PID: 2212)
      • msedgewebview2.exe (PID: 5712)
      • msedgewebview2.exe (PID: 6148)

    • Checks supported languages

      • Bootstrapper.exe (PID: 6784)
      • Luna.exe (PID: 6880)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2928)
      • MicrosoftEdgeUpdate.exe (PID: 5244)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5748)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6200)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5036)
      • MicrosoftEdgeUpdate.exe (PID: 1380)
      • MicrosoftEdgeUpdate.exe (PID: 6692)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • Luna.exe (PID: 6948)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 2736)
      • setup.exe (PID: 3140)
      • setup.exe (PID: 5640)
      • MicrosoftEdgeUpdate.exe (PID: 4120)
      • msedgewebview2.exe (PID: 5712)
      • msedgewebview2.exe (PID: 3816)
      • msedgewebview2.exe (PID: 2212)
      • msedgewebview2.exe (PID: 768)
      • msedgewebview2.exe (PID: 6148)
      • msedgewebview2.exe (PID: 6532)

    • Create files in a temporary directory

      • Bootstrapper.exe (PID: 6784)
      • Luna.exe (PID: 6948)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2928)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • Luna.exe (PID: 6880)
      • msedgewebview2.exe (PID: 2212)

    • Reads the machine GUID from the registry

      • Bootstrapper.exe (PID: 6784)
      • Luna.exe (PID: 6880)
      • Luna.exe (PID: 6948)
      • msedgewebview2.exe (PID: 2212)
      • MicrosoftEdgeUpdate.exe (PID: 6860)

    • Application based on Golang

      • Luna.exe (PID: 6880)
      • Luna.exe (PID: 6948)

    • Detects GO elliptic curve encryption (YARA)

      • Luna.exe (PID: 6880)
      • Luna.exe (PID: 6948)

    • The sample compiled with english language support

      • Luna.exe (PID: 6948)
      • MicrosoftEdgeWebview2Setup.exe (PID: 2928)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 2736)
      • setup.exe (PID: 3140)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 2736)
      • setup.exe (PID: 5640)
      • setup.exe (PID: 3140)
      • msedgewebview2.exe (PID: 3816)
      • msedgewebview2.exe (PID: 2212)
      • msedgewebview2.exe (PID: 6148)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • setup.exe (PID: 3140)
      • msedgewebview2.exe (PID: 768)
      • msedgewebview2.exe (PID: 2212)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6692)
      • MicrosoftEdgeUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdate.exe (PID: 4120)
      • msedgewebview2.exe (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:11:07 20:00:52
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Luna/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
24
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #SLIVERFOX winrar.exe bootstrapper.exe conhost.exe no specs luna.exe luna.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x64_132.0.2957.140.exe setup.exe setup.exe no specs microsoftedgeupdate.exe msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\Luna.exe\EBWebView" --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3532,i,3990983958988006079,8473529907492819888,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1380"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource taggedmi /sessionid "{419A0EC3-11A7-4A4B-85DE-6B247347C102}"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
2212"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Luna.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\admin\AppData\Roaming\Luna.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=6948.1296.7697801967018219811C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
Luna.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2736"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{697FC426-558F-45BE-AC57-C631996D1B88}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{697FC426-558F-45BE-AC57-C631996D1B88}\MicrosoftEdge_X64_132.0.2957.140.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{697fc426-558f-45be-ac57-c631996d1b88}\microsoftedge_x64_132.0.2957.140.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shell32.dll
2928C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Luna.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3140"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{697FC426-558F-45BE-AC57-C631996D1B88}\EDGEMITMP_AB7CF.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{697FC426-558F-45BE-AC57-C631996D1B88}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{697FC426-558F-45BE-AC57-C631996D1B88}\EDGEMITMP_AB7CF.tmp\setup.exe
MicrosoftEdge_X64_132.0.2957.140.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{697fc426-558f-45be-ac57-c631996d1b88}\edgemitmp_ab7cf.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3816C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\Luna.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\Luna.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8205db078,0x7ff8205db084,0x7ff8205db090C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4120"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7NDE5QTBFQzMtMTFBNy00QTRCLTg1REUtNkIyNDczNDdDMTAyfSIgdXNlcmlkPSJ7Rjk1QUY3MUYtM0NDMy00OEQ4LTgxMzctMTVERDIwMTczOEE2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezY0RDBCOEZBLUFGM0EtNDUxNS1BMTg3LTYyNDUwNjdGNjZGRn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuNDA0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJERUxMIiBwcm9kdWN0X25hbWU9IkRFTEwiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEyOTY2Mjg1MDM2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTI5NjY0NDE4ODAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzM4NTkyMzk1MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3MzkxMjE1ODUmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9a1V4YUx3cGhEemJwQVVDQlRoWERvNzRrZ0xhVFJqeUc3TWFZeUpVWFJkekNzcElYZUU1QlFoSkFqSmJtOTF4ZUtLeXJ2eXFkR29NR3RvV2szSUtNbmclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjM3NTQyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMzODU5MjM5NTEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzQwNTc2ODA3NiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3ODk3MTUwMDUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3NjYiIGRvd25sb2FkX3RpbWVfbXM9IjQxOTQ4IiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM4Mzk0Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4556C:\Users\admin\AppData\Local\Temp\EUBA1C.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUBA1C.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\euba1c.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
5036"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.43\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
24 717
Read events
22 170
Write events
2 479
Delete events
68

Modification events

(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Bootstrapper.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
215
Suspicious files
120
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
6784Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6320.7364\Luna\luna\Luna.exeexecutable
MD5:A2842D2B6D2677B12AFEB22F395629F6
SHA256:04A58BD743A1491C156FCDC697399030B98938484BA97BADAED7EEFBA9BEEBD4
6784Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6320.7364\Luna\downloads\Luna.zipcompressed
MD5:3437B2E14BF550D980CC618D675D1B2D
SHA256:64EC1C31B7F360DBE46194776BB40395BE5F01EC558FFD9AB1970924B80ED6CA
6320WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6320.7364\Luna\Bootstrapper.exeexecutable
MD5:F2A6133B7F38FC49F792AE799D1B4750
SHA256:37BDE6655E1272E159B9C2E3A7EEE3F4E9A837C0F04240645D3991D112287F8D
2928MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUBA1C.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:70CC35C7FB88D650902E7A5611219931
SHA256:7ECA199201273F0BCFF1E26778CB535E69C74A69064E7759FF8DAD86954D42B1
6320WinRAR.exeC:\Users\admin\AppData\Local\Temp\Bootstrapper.zipcompressed
MD5:649B780B6F6038477EB04B1BF6B762AA
SHA256:D11C14C105FF0E1F7E5E456062F336F87FF35723BC7D555A3B0A1BFE32BA8F9F
6880Luna.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6320.7364\Luna\autoexec\main.luautext
MD5:D1C70DC9892EC4C910B00A53A8A0E17E
SHA256:BFC03E5837BBCA0953E447B85E839A371532465FE78666F0911B585E850EF0DE
6784Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6320.7364\Luna\config.jsonbinary
MD5:19F3DC4FC394F311B48CE1F400D9AA8B
SHA256:2CFAEA6F6FFC6437F485F43C98AF43ACFD7646070280F0AED7D8C0A97AEAB71D
6320WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_6320.8483compressed
MD5:649B780B6F6038477EB04B1BF6B762AA
SHA256:D11C14C105FF0E1F7E5E456062F336F87FF35723BC7D555A3B0A1BFE32BA8F9F
2928MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUBA1C.tmp\msedgeupdate.dllexecutable
MD5:40CD707DD3011A9845FF9C42256EA7E3
SHA256:9F4C7072716E0BE1BE08207A7024A5E41162E288E677D805BE8E5469A8BD4909
2928MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUBA1C.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:E5DE2B67B2B629859949DB28D614FAAB
SHA256:8C86A415557DA686214675A02A94964F07C2166C811C61542776F4BF920555CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
46
DNS requests
35
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6680
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
968
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6680
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
536
svchost.exe
HEAD
200
2.22.242.91:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739121585&P2=404&P3=2&P4=kUxaLwphDzbpAUCBThXDo74kgLaTRjyG7MaYyJUXRdzCspIXeE5BQhJAjJbm91xeKKyrvyqdGoMGtoWk3IKMng%3d%3d
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
536
svchost.exe
GET
200
2.22.242.91:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739121585&P2=404&P3=2&P4=kUxaLwphDzbpAUCBThXDo74kgLaTRjyG7MaYyJUXRdzCspIXeE5BQhJAjJbm91xeKKyrvyqdGoMGtoWk3IKMng%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.21.65.154:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6784
Bootstrapper.exe
140.82.121.5:443
api.github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.21.65.154
  • 2.21.65.132
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.71
  • 40.126.31.128
  • 20.190.159.0
  • 40.126.31.67
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 184.28.89.167
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.110.133
shared
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 2.22.242.107
  • 2.22.242.129
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
536
svchost.exe
Misc activity
ET INFO Packed Executable Download
6148
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6148
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6148
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6148
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6148
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6148
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming directory exists )
Luna.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bootstrapper.zip