File scan report
Verdict Safe
Is Bootstrapper.
Microsoft-signed Bootstrapper.exe shows zero detections and matches four prior safe Microsoft-signed installers.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Treat as safe for installation or execution when sourced from official Microsoft channels; retain all security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 9
- Code signing Microsoft Corporation
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No engines flagged the file. It is signed by Microsoft Corporation, a trusted publisher, and four of five similar hashes under the same signer were previously rated safe. Sandbox and file it created checks returned no malicious indicators.
The file carries a verified Microsoft signature and zero detections across 75 engines. Four prior Microsoft-signed installers sharing the same signer were rated safe by our analysis. The single malicious RAG match was a .dll with an external CIRCL flag not present here. Sandbox activity maps to generic installer behaviour rather than confirmed malicious techniques.
What We Detected
75 engines scanned the 7.2 MB Win32 EXE; none returned a malicious or suspicious result. The binary is signed by Microsoft Corporation with a verified certificate issued 25 July 2026.
Threat Behavior
One sandbox recorded MITRE T1055 (process injection) and access to the Windows password store, but these map to routine Office-deployment bootstrapper actions. no complete contacted-host reputation result was available, IPs or URLs were contacted. Eight files it created were inspected; none carried malicious verdicts.
What To Do Now
The file can be executed if obtained from an official Microsoft source. Keep Windows Defender and other security software enabled; no disabling is required or advised.
Where this verdict could be wrong1 caveat
- One similar hash (44422e6936dc…) was previously marked malicious under the same signer, but that file was a .dll and carried a CIRCL known-malicious flag absent here.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Verified Microsoft signature
- Zero engine detections
- Four prior safe verdicts under same signer
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 16sandbox rule tags
- 4spawned processes
- 0network contacts
- 12filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1056· Keylogging
- T1057· Lists programs
- T1063
- T1071· Application protocol
- T1082· System recon
- T1112
- T1124
- T1198
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1539
- T1573
Observed activity
Processes started
4Programs the file ran, with their command lines.
odtF1D5.tmp.exe"C:\Users\<USER>\Desktop\odtF1D5.tmp.exe"odtF1D5.tmp.exeodtF1D5.tmp.exe RELAUNCHEDodtF1D5.tmp.exe"C:\Users\user\Desktop\odtF1D5.tmp.exe"odtF1D5.tmp.exeC:\Users\user\Desktop\odtF1D5.tmp.exe odtF1D5.tmp.exe RELAUNCHED
Files
9Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D8A5A88A-4087-4A28-8DE6-03FE29E0AF8E - Written
C:\Users\<USER>\AppData\Local\Temp\DESKTOP-ET51AJO-20260811-1731.log - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\odtf1d5.tmp.exe.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\odtf1d5.tmp.exe.db-journal - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\odtf1d5.tmp.exe.db-wal - Written
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\odtf1d5.tmp.exe.db-shm
Show all 9 entries for files
- Written
C:\Users\user\AppData\Local\Temp\NB-SZ750-20260811-1204.log - Written
\Device\ConDrv\\Connect - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Office\OTele\odtf1d5.tmp.exe.db-journal
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
Office.16.916BB0BF-2D21-4499-83C7-555DB4C3F8E8Local\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office16\Sessions\1\BaseNamedObjects\Office.16.916BB0BF-2D21-4499-83C7-555DB4C3F8E8
Sandbox background — not the file
8The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 8 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4954ff04b4f1df598f9d…718943Not checkedno saved verdict
- 6f226dd4b3300ea7edbd…4b07a3Not checkedno saved verdict
- 5997db5fc4f733a8b724…b827ecNot checkedno saved verdict
- e72652ae79c2d81eef4d…85ae50Not checkedno saved verdict
- 243beb7c2aba433be912…7e21fbNot checkedno saved verdict
- fab808968375cf06317c…51f725Not checkedno saved verdict
- c14eafe68568c50d9d30…65d1bbNot checkedno saved verdict
- 6e7995d612b403994f95…5e5f3eNot checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 31, 2026, 1:03 PM UTC
- SHA-256
f266bc16834fbfae5aa7aca7c27ed5f393cac0bb2acebc2d5bb2dd7813cf7497- SHA-1
c981cf52d88c9b07a621b8ceec04c03a6ff4e72e- MD5
18e5cf683fcf66c78f4bd3b49c0e7f9c
About this file
Bootstrapper.exe is a Win32 EXE file of 7.2 MB.
- Type and size
- Win32 EXE · 7.2 MB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Aug 11, 2026On VirusTotal.
- Submitted by
- 146 distinct sources
- Packer
- None detected
- Entropy
- 7.55 of 8
First scanned Updated
Antivirus consensus
0 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-114 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
Showing the 5 saved rule names of 21 matched.
- Any_SU_Domaingeneric
- BLOWFISH_Constantsgeneric
- Check_OutputDebugStringA_iatgeneric
- CP_Script_Inject_Detectorgeneric
- DebuggerCheck__APIgeneric
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Bootstrapper.exe safe?
What is Bootstrapper.exe?
How many antivirus engines detected Bootstrapper.exe?
Is Bootstrapper.exe digitally signed?
What is the SHA-256 hash of Bootstrapper.exe?
Is it safe to run Bootstrapper.exe?
How up to date is this analysis of Bootstrapper.exe?
Community
Member reviews and reports for this exact file hash.