Malware analysis Bootstrapper.exe Malicious activity | ANY.RUN

Add for printing

File name:	Bootstrapper.exe
Full analysis:	https://app.any.run/tasks/c1bb9eb9-f411-492c-8a95-958db6844630
Verdict:	Malicious activity
Analysis date:	July 31, 2024, 12:31:06
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	pastebin qrcode github
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	365971E549352A15E150B60294EC2E57
SHA1:	2932242B427E81B1B4AC8C11FB17793EAE0939F7
SHA256:	FAAD2BC8E61B75E595A80FF2B6D150FF8B27187A8BA426CC1E5E38E193AB6D42
SSDEEP:	24576:YcAThIl1hqmoeQMhK5Y3/eZFPDVbb3ygK:lboeQMhgY3/eZFPDq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - Bootstrapper.exe (PID: 6444)
  - msiexec.exe (PID: 6912)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - Bootstrapper.exe (PID: 6444)
  - msiexec.exe (PID: 1656)
  - msiexec.exe (PID: 2360)
- Reads the date of Windows installation
  - Bootstrapper.exe (PID: 6444)
- Checks Windows Trust Settings
  - msiexec.exe (PID: 6912)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 6912)
- Uses WEVTUTIL.EXE to install publishers and event logs from the manifest
  - msiexec.exe (PID: 2360)
  - wevtutil.exe (PID: 6584)
- Executable content was dropped or overwritten
  - Bootstrapper.exe (PID: 6444)
- The process drops C-runtime libraries
  - Bootstrapper.exe (PID: 6444)
- Process drops legitimate windows executable
  - Bootstrapper.exe (PID: 6444)
INFO
- Disables trace logs
  - Bootstrapper.exe (PID: 6444)
- Reads the computer name
  - Bootstrapper.exe (PID: 6444)
  - msiexec.exe (PID: 6912)
  - msiexec.exe (PID: 1664)
  - msiexec.exe (PID: 1656)
  - msiexec.exe (PID: 2360)
- Reads the machine GUID from the registry
  - Bootstrapper.exe (PID: 6444)
  - msiexec.exe (PID: 6912)
- Checks supported languages
  - Bootstrapper.exe (PID: 6444)
  - msiexec.exe (PID: 6912)
  - msiexec.exe (PID: 1664)
  - msiexec.exe (PID: 1656)
  - msiexec.exe (PID: 2360)
- Checks proxy server information
  - Bootstrapper.exe (PID: 6444)
- Reads Environment values
  - Bootstrapper.exe (PID: 6444)
- Create files in a temporary directory
  - Bootstrapper.exe (PID: 6444)
- Reads the software policy settings
  - Bootstrapper.exe (PID: 6444)
  - msiexec.exe (PID: 6912)
- Process checks computer location settings
  - Bootstrapper.exe (PID: 6444)
- Creates files or folders in the user directory
  - msiexec.exe (PID: 6912)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 6912)
- Application launched itself
  - msiexec.exe (PID: 6912)
- Dropped object may contain TOR URL's
  - Bootstrapper.exe (PID: 6444)
- Creates a software uninstall entry
  - msiexec.exe (PID: 6912)
- Creates files in the program directory
  - Bootstrapper.exe (PID: 6444)
- Manual execution by a user
  - Taskmgr.exe (PID: 6316)
  - Taskmgr.exe (PID: 6724)
- Reads security settings of Internet Explorer
  - Taskmgr.exe (PID: 6724)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe	\|	Win64 Executable (generic) (23.8)
.dll	\|	Win32 Dynamic Link Library (generic) (5.6)
.exe	\|	Win32 Executable (generic) (3.8)
.exe	\|	Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2024:07:29 21:02:19+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	8
CodeSize:	812032
InitializedDataSize:	2048
UninitializedDataSize:	-
EntryPoint:	0xc81fa
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows command line
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	-
CompanyName:	-
FileDescription:	SolaraBootstrapper
FileVersion:	1.0.0.0
InternalName:	SolaraBootstrapper.exe
LegalCopyright:	Copyright © 2024
LegalTrademarks:	-
OriginalFileName:	SolaraBootstrapper.exe
ProductName:	SolaraBootstrapper
ProductVersion:	1.0.0.0
AssemblyVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

158

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1452

"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64

C:\Windows\System32\wevtutil.exe

—

wevtutil.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Eventing Command Line Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\sechost.dll

1656

C:\Windows\syswow64\MsiExec.exe -Embedding 91332331D4D35801036971B3F1F21EB4

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

1664

C:\Windows\System32\MsiExec.exe -Embedding D25B61360F59F7D4CEFDBF4B674E3F2E

C:\Windows\System32\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2360

C:\Windows\syswow64\MsiExec.exe -Embedding 6F012175B62548C1E01657845708DB84 E Global\MSI0000

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

6032

"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn

C:\Windows\SysWOW64\msiexec.exe

—

Bootstrapper.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

6316

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Task Manager

Exit code:

3221226540

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll

6380

"C:\Users\admin\AppData\Local\Temp\Bootstrapper.exe"

C:\Users\admin\AppData\Local\Temp\Bootstrapper.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

SolaraBootstrapper

Exit code:

3221226540

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

6444

"C:\Users\admin\AppData\Local\Temp\Bootstrapper.exe"

C:\Users\admin\AppData\Local\Temp\Bootstrapper.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Description:

SolaraBootstrapper

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

6460

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

Bootstrapper.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6568

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

wevtutil.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

18 178

Read events

15 230

Write events

2 938

Delete events

Modification events


(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6444) Bootstrapper.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0

Add for printing

Executable files

Suspicious files

876

Text files

1 592

Unknown types

Dropped files

PID	Process	Filename		Type
6444	Bootstrapper.exe	C:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi		—
		MD5:—	SHA256:—
6912	msiexec.exe	C:\Windows\Installer\eab10.msi		—
		MD5:—	SHA256:—
6912	msiexec.exe	C:\Windows\Installer\MSIADA1.tmp		executable
		MD5:9FE9B0ECAEA0324AD99036A91DB03EBB	SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
6912	msiexec.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5		binary
		MD5:D35F0A21C9EE3A33E0D1542788AB506D	SHA256:F89DC4A7D15C29512179D8450F93F61EFD2EE88EA5645662D3346CC86AA92B09
6912	msiexec.exe	C:\Windows\Installer\MSIC13E.tmp		executable
		MD5:A3AE5D86ECF38DB9427359EA37A5F646	SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
6912	msiexec.exe	C:\Windows\Installer\MSIC15F.tmp		executable
		MD5:7A86CE1A899262DD3C1DF656BFF3FB2C	SHA256:B8F2D0909D7C2934285A8BE010D37C0609C7854A36562CBFCBCE547F4F4C7B0C
6912	msiexec.exe	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff-apply\index.mjs		text
		MD5:F18972E106C0D8F1918BC46145F7492B	SHA256:9456B0BBD75BD75A879464E60B482AF73BEBAA1E56578397713BC29D6FFD0E7F
6912	msiexec.exe	C:\Windows\Installer\inprogressinstallinfo.ipi		binary
		MD5:C75C7CFADD259A01B38F551B404BC01A	SHA256:E61C19AB91586F015627F229D28E7B793D85FCD91F2CB173A1E9D842CC547A8F
6912	msiexec.exe	C:\Windows\Installer\MSIADE0.tmp		executable
		MD5:9FE9B0ECAEA0324AD99036A91DB03EBB	SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
6912	msiexec.exe	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE		text
		MD5:D2CF52AA43E18FDC87562D4C1303F46A	SHA256:45E433413760DC3AE8169BE5ED9C2C77ADC31AD4D1BC5A28939576DF240F29A0

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
5552	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7036	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6956	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6912	msiexec.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D	unknown	—	—	whitelisted
6912	msiexec.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4484	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5240	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2120	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6444	Bootstrapper.exe	104.20.3.235:443	pastebin.com	CLOUDFLARENET	—	unknown
6444	Bootstrapper.exe	128.116.123.3:443	clientsettings.roblox.com	ROBLOX-PRODUCTION	US	malicious
6444	Bootstrapper.exe	104.20.23.46:443	www.nodejs.org	CLOUDFLARENET	—	shared
6444	Bootstrapper.exe	104.20.22.46:443	www.nodejs.org	CLOUDFLARENET	—	shared
4	System	192.168.100.255:137	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.104.136.2	whitelisted
google.com	142.250.184.206	whitelisted
pastebin.com	104.20.3.235 172.67.19.24 104.20.4.235	shared
clientsettings.roblox.com	128.116.123.3	whitelisted
www.nodejs.org	104.20.23.46 104.20.22.46	whitelisted
nodejs.org	104.20.22.46 104.20.23.46	whitelisted
www.bing.com	104.126.37.146 104.126.37.161 104.126.37.160 104.126.37.163 104.126.37.162 104.126.37.145 104.126.37.153 104.126.37.152 104.126.37.155 104.126.37.128 104.126.37.144 104.126.37.130 104.126.37.131 104.126.37.186 104.126.37.170 104.126.37.139 104.126.37.171 104.126.37.123	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.159.2 20.190.159.0 20.190.159.4 20.190.159.73 40.126.31.71 20.190.159.68 20.190.159.23 20.190.159.75	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted

Threats

PID	Process	Class	Message
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Online Pastebin Text Storage
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub

Add for printing

No debug info

General Info

Bootstrapper.exe

365971E549352A15E150B60294EC2E57

2932242B427E81B1B4AC8C11FB17793EAE0939F7

FAAD2BC8E61B75E595A80FF2B6D150FF8B27187A8BA426CC1E5E38E193AB6D42

24576:YcAThIl1hqmoeQMhK5Y3/eZFPDVbb3ygK:lboeQMhgY3/eZFPDq

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

SUSPICIOUS

Reads security settings of Internet Explorer

Reads the date of Windows installation

Checks Windows Trust Settings

Reads the Windows owner or organization settings

Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

Executable content was dropped or overwritten

The process drops C-runtime libraries

Process drops legitimate windows executable

INFO

Disables trace logs

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Checks proxy server information

Reads Environment values

Create files in a temporary directory

Reads the software policy settings

Process checks computer location settings

Creates files or folders in the user directory

Executable content was dropped or overwritten

Application launched itself

Dropped object may contain TOR URL's

Creates a software uninstall entry

Creates files in the program directory

Manual execution by a user

Reads security settings of Internet Explorer

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings