download:

/cmd-softworks/solara/raw/main/Bootstrapper.exe

Full analysis: https://app.any.run/tasks/2ef7271a-b868-4d23-900e-fdd2ae1e1c92
Verdict: Malicious activity
Analysis date: July 26, 2024, 18:00:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
qrcode
github
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D674B62B359B2EC81398348904F8BEE9

SHA1:

609D29C3D5503BC382AB55188E67E002EB8270A7

SHA256:

95486D06DB5126EB557C563B5597E08B236634F75853A6491C485CB64CF28AE2

SSDEEP:

12288:M/YtlkXGfqKBwQjocHXhwZ0oRy7btb6U9Aubfh/dYl03n:M/VXGfqKB1jocHXhwgyubfh/dYl0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 3980)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3980)

    • Reads security settings of Internet Explorer

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 6164)
      • msiexec.exe (PID: 5396)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3980)

    • Process drops legitimate windows executable

      • Bootstrapper.exe (PID: 2508)

    • Executable content was dropped or overwritten

      • Bootstrapper.exe (PID: 2508)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • msiexec.exe (PID: 5396)
      • wevtutil.exe (PID: 3720)

    • The process drops C-runtime libraries

      • Bootstrapper.exe (PID: 2508)

    • Executes script using NodeJS

      • node.exe (PID: 6112)

    • Executes application which crashes

      • Solara.exe (PID: 6124)

    • Reads the BIOS version

      • Solara.exe (PID: 6124)

  • INFO

    • Checks proxy server information

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • WerFault.exe (PID: 3488)

    • Disables trace logs

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)

    • Reads Environment values

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • node.exe (PID: 6112)

    • Reads the computer name

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 6200)
      • msiexec.exe (PID: 6164)
      • msiexec.exe (PID: 3980)
      • Bootstrapper.exe (PID: 3816)
      • msiexec.exe (PID: 5396)
      • Solara.exe (PID: 6124)

    • Checks supported languages

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 6164)
      • msiexec.exe (PID: 6200)
      • msiexec.exe (PID: 5396)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)
      • node.exe (PID: 1476)
      • node.exe (PID: 6112)

    • Reads the software policy settings

      • Bootstrapper.exe (PID: 2508)
      • msiexec.exe (PID: 3980)
      • Bootstrapper.exe (PID: 3816)
      • WerFault.exe (PID: 3488)
      • Solara.exe (PID: 6124)

    • Create files in a temporary directory

      • Bootstrapper.exe (PID: 2508)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3980)
      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)
      • Solara.exe (PID: 6124)

    • Process checks computer location settings

      • Bootstrapper.exe (PID: 2508)
      • Bootstrapper.exe (PID: 3816)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3980)
      • WerFault.exe (PID: 3488)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3980)

    • Application launched itself

      • msiexec.exe (PID: 3980)

    • Manual execution by a user

      • Bootstrapper.exe (PID: 3152)
      • Bootstrapper.exe (PID: 3816)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3980)

    • Creates files in the program directory

      • Bootstrapper.exe (PID: 2508)

    • Dropped object may contain TOR URL's

      • Bootstrapper.exe (PID: 2508)

    • Reads product name

      • node.exe (PID: 6112)

    • Process checks whether UAC notifications are on

      • Solara.exe (PID: 6124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:26 16:54:51+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 809984
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc7ade
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: SolaraBootstrapper
FileVersion: 1.0.0.0
InternalName: SolaraBootstrapper.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: SolaraBootstrapper.exe
ProductName: SolaraBootstrapper
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
22
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bootstrapper.exe conhost.exe no specs slui.exe no specs slui.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs bootstrapper.exe no specs bootstrapper.exe conhost.exe no specs node.exe no specs conhost.exe no specs solara.exe node.exe no specs conhost.exe no specs werfault.exe bootstrapper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1476"node" -vC:\Program Files\nodejs\node.exe—Bootstrapper.exe
User:
admin
Company:
Node.js
Integrity Level:
HIGH
Description:
Node.js JavaScript Runtime
Exit code:
0
Version:
18.16.0
Modules
Images
c:\program files\nodejs\node.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1584C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2508"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3152"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3488C:\WINDOWS\system32\WerFault.exe -u -p 6124 -s 2936C:\Windows\System32\WerFault.exe
Solara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
3720"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"C:\Windows\SysWOW64\wevtutil.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll
3816"C:\Users\admin\Desktop\Bootstrapper.exe" C:\Users\admin\Desktop\Bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3980C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
23 731
Read events
20 743
Write events
2 973
Delete events
15

Modification events

(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2508) Bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bootstrapper_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
33
Suspicious files
852
Text files
1 608
Unknown types
23

Dropped files

PID
Process
Filename
Type
2508Bootstrapper.exeC:\Users\admin\AppData\Local\Temp\node-v18.16.0-x64.msi —
MD5:—
SHA256:—
3980msiexec.exeC:\Windows\Installer\1c8091.msi —
MD5:—
SHA256:—
3980msiexec.exeC:\Windows\Installer\MSI8B81.tmpbinary
MD5:AD5653138261DD35589B51BAFA6D1DC3
SHA256:79ED7DE40BF8BAFDE867216D07B849510EB44A3D27C79009CC48DDE6AED9C2C3
3980msiexec.exeC:\Windows\Temp\~DF780D2A5219088B0F.TMPbinary
MD5:AB1972B39739595306897EAE822F0CE3
SHA256:AC97F8CC663F89583A62E641C90B3176DCA4F9353A6443DE793B78944DE5BB4C
3980msiexec.exeC:\Windows\Installer\MSI8ECE.tmpexecutable
MD5:7A86CE1A899262DD3C1DF656BFF3FB2C
SHA256:B8F2D0909D7C2934285A8BE010D37C0609C7854A36562CBFCBCE547F4F4C7B0C
3980msiexec.exeC:\Windows\Installer\MSI8312.tmpexecutable
MD5:9FE9B0ECAEA0324AD99036A91DB03EBB
SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
3980msiexec.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.logtext
MD5:A82C8DB1AB1E68579F79D124D142D810
SHA256:9702656F4BD01A2746B2A5E43CD3F77A46645CB2C7B533018FCEA9D973EB0E7D
3980msiexec.exeC:\Windows\Installer\MSI8361.tmpexecutable
MD5:9FE9B0ECAEA0324AD99036A91DB03EBB
SHA256:E2CCE64916E405976A1D0C522B44527D12B1CBA19DE25DA62121CF5F41D184C9
3980msiexec.exeC:\Windows\Installer\MSI8381.tmpexecutable
MD5:A3AE5D86ECF38DB9427359EA37A5F646
SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
3980msiexec.exeC:\Windows\Installer\MSI9C8C.tmpexecutable
MD5:A3AE5D86ECF38DB9427359EA37A5F646
SHA256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
63
DNS requests
33
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
1516
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3980
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D
unknown
—
—
whitelisted
3980
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
204
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4436
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.20.142.138:443
www.bing.com
Akamai International B.V.
DE
unknown
4560
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.20.142.138
  • 92.122.215.98
  • 92.122.215.74
  • 2.20.142.146
  • 2.20.142.122
  • 2.20.142.179
  • 2.20.142.154
  • 2.20.142.178
  • 2.20.142.162
whitelisted
google.com
  • 142.250.185.206
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.60
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.67
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
pastebin.com
  • 104.20.4.235
  • 104.20.3.235
  • 172.67.19.24
shared

Threats

PID
Process
Class
Message
2284
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2284
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/cmd-softworks/solara/raw/main/Bootstrapper.exe