download:

/cmd-softworks/solara/raw/main/Bootstrapper.exe

Full analysis: https://app.any.run/tasks/2ef7271a-b868-4d23-900e-fdd2ae1e1c92
Verdict: Malicious activity
Analysis date: July 26, 2024, 18:00:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
qrcode
github
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D674B62B359B2EC81398348904F8BEE9

SHA1:

609D29C3D5503BC382AB55188E67E002EB8270A7

SHA256:

95486D06DB5126EB557C563B5597E08B236634F75853A6491C485CB64CF28AE2

SSDEEP:

12288:M/YtlkXGfqKBwQjocHXhwZ0oRy7btb6U9Aubfh/dYl03n:M/VXGfqKB1jocHXhwgyubfh/dYl0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 3980)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 6164)
      • msiexec.exe (PID: 5396)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3980)

    • Executable content was dropped or overwritten

      • Bootstrapper.exe (PID: 2508)

    • Process drops legitimate windows executable

      • Bootstrapper.exe (PID: 2508)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • msiexec.exe (PID: 5396)
      • wevtutil.exe (PID: 3720)

    • The process drops C-runtime libraries

      • Bootstrapper.exe (PID: 2508)

    • Reads the date of Windows installation

      • Bootstrapper.exe (PID: 3816)
      • Bootstrapper.exe (PID: 2508)

    • Executes script using NodeJS

      • node.exe (PID: 6112)

    • Reads the BIOS version

      • Solara.exe (PID: 6124)

    • Executes application which crashes

      • Solara.exe (PID: 6124)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3980)

  • INFO

    • Reads Environment values

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • node.exe (PID: 6112)

    • Reads the computer name

      • msiexec.exe (PID: 3980)
      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 6200)
      • msiexec.exe (PID: 6164)
      • msiexec.exe (PID: 5396)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3980)
      • WerFault.exe (PID: 3488)

    • Disables trace logs

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)

    • Checks supported languages

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 6164)
      • msiexec.exe (PID: 6200)
      • msiexec.exe (PID: 5396)
      • Bootstrapper.exe (PID: 3816)
      • node.exe (PID: 1476)
      • Solara.exe (PID: 6124)
      • node.exe (PID: 6112)
      • msiexec.exe (PID: 3980)

    • Checks proxy server information

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • WerFault.exe (PID: 3488)

    • Reads the machine GUID from the registry

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • msiexec.exe (PID: 3980)

    • Create files in a temporary directory

      • Bootstrapper.exe (PID: 2508)

    • Application launched itself

      • msiexec.exe (PID: 3980)

    • Reads the software policy settings

      • msiexec.exe (PID: 3980)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • WerFault.exe (PID: 3488)
      • Bootstrapper.exe (PID: 2508)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3980)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3980)

    • Creates files in the program directory

      • Bootstrapper.exe (PID: 2508)

    • Dropped object may contain TOR URL's

      • Bootstrapper.exe (PID: 2508)

    • Process checks computer location settings

      • Bootstrapper.exe (PID: 3816)
      • Bootstrapper.exe (PID: 2508)

    • Manual execution by a user

      • Bootstrapper.exe (PID: 3152)
      • Bootstrapper.exe (PID: 3816)

    • Process checks whether UAC notifications are on

      • Solara.exe (PID: 6124)

    • Reads product name

      • node.exe (PID: 6112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:26 16:54:51+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 809984
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc7ade
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: SolaraBootstrapper
FileVersion: 1.0.0.0
InternalName: SolaraBootstrapper.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: SolaraBootstrapper.exe
ProductName: SolaraBootstrapper
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
22
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bootstrapper.exe conhost.exe no specs slui.exe no specs slui.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs solara.exe node.exe no specs conhost.exe no specs werfault.exe bootstrapper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1476"node" -vC:\Program Files\nodejs\node.exe—Bootstrapper.exe
User:
admin
Company:
Node.js
Integrity Level:
HIGH
Description:
Node.js JavaScript Runtime
Exit code:
0
Version:
18.16.0
Modules
Images
c:\program files\nodejs\node.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1584C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2508"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3152"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3488C:\WINDOWS\system32\WerFault.exe -u -p 6124 -s 2936C:\Windows\System32\WerFault.exe
Solara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
3720"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"C:\Windows\SysWOW64\wevtutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll
3816"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3980C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
23 731
Read events
20 743
Write events
2 973
Delete events
15

Modification events

(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
33
Suspicious files
852
Text files
1 608
Unknown types
23

Dropped files

PID
Process
Filename
Type
2508Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi —
MD5:—
SHA256:—
3980msiexec.exeC:\Windows\Installer\1c8091.msi —
MD5:—
SHA256:—
3980msiexec.exeC:\Program Files\nodejs\corepacktext
MD5:1A27E3E2F449816F5FFCDD57703A3F78
SHA256:DCEF0A787C4654AC5C085FAFA3A1E12D60D6F42E0D259C38378B61EF64295FA2
3980msiexec.exeC:\Program Files\nodejs\node_modules\npm\node_modules\just-diff-apply\index.mjstext
MD5:F18972E106C0D8F1918BC46145F7492B
SHA256:9456B0BBD75BD75A879464E60B482AF73BEBAA1E56578397713BC29D6FFD0E7F
3980msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5binary
MD5:F9BD93BEF82BE4B6D3B8AC6174828A92
SHA256:F638813B693B9D466C93807A8A3852EA2F9663BDD97F10B2BF1D03AFDE4BC65F
3980msiexec.exeC:\Windows\Temp\~DF780D2A5219088B0F.TMPbinary
MD5:AB1972B39739595306897EAE822F0CE3
SHA256:AC97F8CC663F89583A62E641C90B3176DCA4F9353A6443DE793B78944DE5BB4C
3980msiexec.exeC:\Windows\Installer\MSI8361.tmpexecutable
MD5:9FE9B0ECAEA0324AD99036A91DB03EBB
SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
3980msiexec.exeC:\Windows\Installer\MSI8312.tmpexecutable
MD5:9FE9B0ECAEA0324AD99036A91DB03EBB
SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
3980msiexec.exeC:\Program Files\nodejs\node_modules\npm\node_modules\infer-owner\package.jsonbinary
MD5:58E93686667E60B9FEC554FA82C599FE
SHA256:231F7DC0CB817956B5FE363A18F0C935D62A5213D5CB796AB940D5A7C6A7BDA4
3980msiexec.exeC:\Windows\Installer\MSI8B81.tmpbinary
MD5:AD5653138261DD35589B51BAFA6D1DC3
SHA256:79ED7DE40BF8BAFDE867216D07B849510EB44A3D27C79009CC48DDE6AED9C2C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
63
DNS requests
33
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1516
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3980
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
3980
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
204
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4436
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.20.142.138:443
www.bing.com
Akamai International B.V.
DE
unknown
4560
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.20.142.138
  • 92.122.215.98
  • 92.122.215.74
  • 2.20.142.146
  • 2.20.142.122
  • 2.20.142.179
  • 2.20.142.154
  • 2.20.142.178
  • 2.20.142.162
whitelisted
google.com
  • 142.250.185.206
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.67
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
pastebin.com
  • 104.20.4.235
  • 104.20.3.235
  • 172.67.19.24
shared

Threats

PID
Process
Class
Message
2284
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2284
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/cmd-softworks/solara/raw/main/Bootstrapper.exe