File name:

BootstrapperV1.22.exe

Full analysis: https://app.any.run/tasks/f05e131d-84ca-4ae5-9ace-071fe3583b32
Verdict: Malicious activity
Analysis date: July 08, 2025, 18:06:29
OS: Windows 10 Professional (build: 19044, 64 bit)
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2A4DCF20B82896BE94EB538260C5FB93

SHA1:

21F232C2FD8132F8677E53258562AD98B455E679

SHA256:

EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A

SSDEEP:

6144:LQ3tXkS2NIikH1izJZ3e82Zavp/ijHrGEW1IhThuENaDffKTghOpDozwKdVuaQ:LiMIikViCocauhu6TghOpDkwKdw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • BootstrapperV1.22.exe (PID: 3908)

    • Uses WMIC.EXE to obtain information about the network interface controller

      • cmd.exe (PID: 7160)

    • Executable content was dropped or overwritten

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7020)

    • Reads security settings of Internet Explorer

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Reads the date of Windows installation

      • BootstrapperV1.22.exe (PID: 3908)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 7020)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Process drops legitimate windows executable

      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7020)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 4236)

  • INFO

    • Reads the computer name

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Reads the machine GUID from the registry

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)

    • Checks supported languages

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7020)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Checks proxy server information

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 4236)
      • wermgr.exe (PID: 3924)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1512)

    • Process checks computer location settings

      • BootstrapperV1.22.exe (PID: 3908)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Reads Environment values

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Reads the software policy settings

      • BootstrapperV1.22.exe (PID: 3908)
      • wermgr.exe (PID: 3924)
      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Create files in a temporary directory

      • BootstrapperV1.22.exe (PID: 3908)
      • BootstrapperV2.23.exe (PID: 6388)

    • Creates files in the program directory

      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7020)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • BootstrapperV2.23.exe (PID: 6388)

    • Disables trace logs

      • BootstrapperV2.23.exe (PID: 6388)
      • BootstrapperV1.22.exe (PID: 3908)

    • The sample compiled with english language support

      • BootstrapperV2.23.exe (PID: 6388)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7020)
      • MicrosoftEdgeUpdate.exe (PID: 4236)

    • Creates files or folders in the user directory

      • wermgr.exe (PID: 3924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:04 22:29:32+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 816640
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc949a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: SolaraBootstrapper
FileVersion: 1.0.0.0
InternalName: SolaraBootstrapper.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: SolaraBootstrapper.exe
ProductName: SolaraBootstrapper
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
11
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bootstrapperv1.22.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs bootstrapperv2.23.exe microsoftedgewebview2setup.exe no specs microsoftedgeupdate.exe wermgr.exe slui.exe no specs bootstrapperv1.22.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—BootstrapperV1.22.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\ucrtbase.dll
3908"C:\Users\admin\AppData\Local\Temp\BootstrapperV1.22.exe" C:\Users\admin\AppData\Local\Temp\BootstrapperV1.22.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrapperv1.22.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3924"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "4236" "1848" "1876" "1700" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4236"C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.61
Modules
Images
c:\program files (x86)\microsoft\temp\eube9d.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4692"C:\Users\admin\AppData\Local\Temp\BootstrapperV1.22.exe" C:\Users\admin\AppData\Local\Temp\BootstrapperV1.22.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SolaraBootstrapper
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrapperv1.22.exe
c:\windows\system32\ntdll.dll
5060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5496C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388"C:\Users\admin\AppData\Local\Temp\BootstrapperV2.23.exe" --oldBootstrapper "C:\Users\admin\AppData\Local\Temp\BootstrapperV1.22.exe" --isUpdate trueC:\Users\admin\AppData\Local\Temp\BootstrapperV2.23.exe
BootstrapperV1.22.exe
User:
admin
Integrity Level:
HIGH
Description:
Bootstrapper
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bootstrapperv2.23.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7020"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe—BootstrapperV2.23.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.61
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
13 732
Read events
13 670
Write events
60
Delete events
2

Modification events

(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3908) BootstrapperV1.22.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BootstrapperV1_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
202
Suspicious files
4
Text files
7
Unknown types
4

Dropped files

PID
Process
Filename
Type
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:D65C7E1B579CD5ABA05D65D5FF0002AD
SHA256:5F2A785AEA8F1EAFD0B473722C95B1178A684734DA79BE28D3A445470F810062
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:7AE279F8F5FC1A139FC3FA06BF28BC59
SHA256:9E259500EBA6A26384161A28A92F2DEDBDD6B1073DE46D8FEC74E03762E031D4
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:1AD4DC4005B4A88D0473358F31491923
SHA256:E6E0518993662FE479B0F1D1F2F93C81A2B19C517A007B3FF5B8D1AF5FDAF5C4
6388BootstrapperV2.23.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:5424BAC02DB3D21E75C21FF2049CD04F
SHA256:3C60FDBD71B468CF52FDE6F780740A910C9D190E7023B1AC1217D427D794CCB1
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\psuser_64.dllexecutable
MD5:453F76E388CEBC59FE758023FECE841A
SHA256:5D0A80FAB1F2CA7B0434BB5EBDE5D4401DC91967C946B4FFE7B3EFC52E6EEDD8
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:B552E2C44C71C93E4AAE5411357BDE40
SHA256:C6EA70D4372A37A6EE06B35C1F6E1B2668B39005FC2D71347BF6FD3BF680B316
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:570D4E78E4EF679C9435247685F8A8D3
SHA256:5CDF1C3C7F72120CA88145D38E48C9E1E6A6BD4EF43021193FD76D98D2F05496
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\psuser_arm64.dllexecutable
MD5:0A9E22D7E11B698C3665F5F0B53F1E49
SHA256:CCA43D97C1AE15B54C10B778670044A6EE413C4545D9DC554CCCB527FBF3DFEE
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
7020MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\EdgeUpdate.dathiv
MD5:369BBC37CFF290ADB8963DC5E518B9B8
SHA256:3D7EC761BEF1B1AF418B909F1C81CE577C769722957713FDAFBC8131B0A0C7D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
22
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2524
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1328
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3924
wermgr.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1328
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3924
wermgr.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2200
svchost.exe
224.0.0.251:5353
—
—
—
unknown
2200
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1268
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3908
BootstrapperV1.22.exe
104.21.93.27:443
getsolara.dev
CLOUDFLARENET
—
unknown
2524
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.20
  • 23.216.77.8
  • 23.216.77.15
  • 23.216.77.27
  • 23.216.77.16
  • 23.216.77.11
  • 23.216.77.13
  • 23.216.77.26
  • 184.24.77.35
  • 184.24.77.37
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 95.101.149.131
whitelisted
getsolara.dev
  • 104.21.93.27
  • 172.67.203.125
unknown
login.live.com
  • 40.126.31.130
  • 40.126.31.3
  • 20.190.159.71
  • 20.190.159.131
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BootstrapperV1.22.exe