File name:

Solara.exe

Full analysis: https://app.any.run/tasks/bdad1741-f826-43f7-868c-7e317a40e784
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 31, 2024, 09:43:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
pastebin
python
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

545918EC8CFF24A208EB6EB045175BD5

SHA1:

20FB9488D8EC565943475542E0ED7268B8CD6A68

SHA256:

F7904A2A0059EE037D9603355EE725875D6B63A7197D03692E755DA3A827358D

SSDEEP:

98304:uMRrFsecSmMjFEm9gWXcphCQncFNJ2D8u8W90GhrbZvIDzwuQxGZp9WJ3G5xvODM:yYKr/dmTyTIjPq1l9y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Bootstrapper.exe (PID: 4876)

    • Create files in the Startup directory

      • powershell.exe (PID: 2816)

  • SUSPICIOUS

    • Application launched itself

      • Solara.exe (PID: 7052)
      • Tool.exe (PID: 6884)

    • Reads Internet Explorer settings

      • Solara.exe (PID: 7052)

    • Reads Microsoft Outlook installation path

      • Solara.exe (PID: 7052)

    • Reads security settings of Internet Explorer

      • Solara.exe (PID: 7052)
      • Solara.exe (PID: 4816)
      • Bootstrapper.exe (PID: 4876)
      • msiexec.exe (PID: 4976)

    • Reads the date of Windows installation

      • Solara.exe (PID: 7052)
      • Solara.exe (PID: 4816)
      • Bootstrapper.exe (PID: 4876)

    • Drops the executable file immediately after the start

      • Solara.exe (PID: 4816)
      • Tool.exe (PID: 6884)
      • msiexec.exe (PID: 232)

    • Executable content was dropped or overwritten

      • Solara.exe (PID: 4816)
      • Tool.exe (PID: 6884)

    • The process drops C-runtime libraries

      • Tool.exe (PID: 6884)

    • Process drops legitimate windows executable

      • Tool.exe (PID: 6884)

    • Process drops python dynamic module

      • Tool.exe (PID: 6884)

    • Creates file in the systems drive root

      • Tool.exe (PID: 6956)

    • Loads Python modules

      • Tool.exe (PID: 6956)

    • Starts CMD.EXE for commands execution

      • Tool.exe (PID: 6956)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6020)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 232)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 232)

  • INFO

    • The process uses the downloaded file

      • Solara.exe (PID: 7052)
      • Solara.exe (PID: 4816)
      • Bootstrapper.exe (PID: 4876)

    • Checks proxy server information

      • Solara.exe (PID: 7052)
      • Bootstrapper.exe (PID: 4876)

    • Reads the computer name

      • Solara.exe (PID: 7052)
      • Solara.exe (PID: 4816)
      • Tool.exe (PID: 6884)
      • Bootstrapper.exe (PID: 4876)
      • msiexec.exe (PID: 232)
      • msiexec.exe (PID: 6128)
      • msiexec.exe (PID: 4976)

    • Process checks Internet Explorer phishing filters

      • Solara.exe (PID: 7052)

    • Checks supported languages

      • Solara.exe (PID: 7052)
      • Solara.exe (PID: 4816)
      • Bootstrapper.exe (PID: 4876)
      • Tool.exe (PID: 6956)
      • Tool.exe (PID: 6884)
      • msiexec.exe (PID: 232)
      • msiexec.exe (PID: 6128)
      • msiexec.exe (PID: 4976)

    • Process checks computer location settings

      • Solara.exe (PID: 7052)
      • Solara.exe (PID: 4816)
      • Bootstrapper.exe (PID: 4876)

    • Creates files in the program directory

      • Solara.exe (PID: 4816)
      • Bootstrapper.exe (PID: 4876)

    • Reads the machine GUID from the registry

      • Bootstrapper.exe (PID: 4876)
      • Tool.exe (PID: 6956)
      • msiexec.exe (PID: 232)

    • Reads Environment values

      • Bootstrapper.exe (PID: 4876)

    • Disables trace logs

      • Bootstrapper.exe (PID: 4876)

    • Reads the software policy settings

      • Bootstrapper.exe (PID: 4876)
      • msiexec.exe (PID: 232)

    • Create files in a temporary directory

      • Tool.exe (PID: 6884)
      • Bootstrapper.exe (PID: 4876)
      • Tool.exe (PID: 6956)

    • Application launched itself

      • msiexec.exe (PID: 232)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 232)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:12 10:17:15+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 236032
InitializedDataSize: 270848
UninitializedDataSize: -
EntryPoint: 0x266b0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
15
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start solara.exe no specs solara.exe bootstrapper.exe conhost.exe no specs tool.exe tool.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe sppextcomobj.exe no specs slui.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2816powershell "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tool.exe.lnk'); $s.TargetPath = 'C:\Program Files\Tool.exe'; $s.Arguments = 'C:\Users\admin\AppData\Local\Temp\_MEI68842\Tool.py'; $s.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4816"C:\Users\admin\AppData\Local\Temp\Solara.exe" -el -s2 "-dC:\Program Files" "-sp"C:\Users\admin\AppData\Local\Temp\Solara.exe
Solara.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\solara.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4876"C:\Program Files\Bootstrapper.exe" C:\Program Files\Bootstrapper.exe
Solara.exe
User:
admin
Integrity Level:
HIGH
Description:
SolaraBootstrapper
Version:
1.0.0.0
Modules
Images
c:\program files\bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4976C:\Windows\syswow64\MsiExec.exe -Embedding 3D12A7848C8991C2809B7971E362FDBAC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5920C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6020C:\WINDOWS\system32\cmd.exe /c "powershell "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tool.exe.lnk'); $s.TargetPath = 'C:\Program Files\Tool.exe'; $s.Arguments = 'C:\Users\admin\AppData\Local\Temp\_MEI68842\Tool.py'; $s.Save()""C:\Windows\System32\cmd.exe—Tool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6128C:\Windows\System32\MsiExec.exe -Embedding E4D6D94550D0CA25A5363D55A296D2A6C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
25 373
Read events
22 592
Write events
2 779
Delete events
2

Modification events

(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(7052) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(4816) Solara.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
71
Suspicious files
390
Text files
652
Unknown types
7

Dropped files

PID
Process
Filename
Type
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_queue.pydexecutable
MD5:328E41B501A51B58644C7C6930B03234
SHA256:2782CF3C04801EDE65011BE282E99CD34D163B2B2B2333FD3147B33F7D5E72AB
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_bz2.pydexecutable
MD5:B024A6F227EAFA8D43EDFC1A560FE651
SHA256:C0DD9496B19BA9536A78A43A97704E7D4BEF3C901D196ED385E771366682819D
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_hashlib.pydexecutable
MD5:69DC506CF2FA3DA9D0CABA05FCA6A35D
SHA256:C5B8C4582E201FEF2D8CB2C8672D07B86DEC31AFB4A17B758DBFB2CFF163B12F
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_decimal.pydexecutable
MD5:FF0BF710EB2D7817C49E1F4E21502073
SHA256:C6EB532DA62A115AE75F58766B632E005140A2E7C9C67A77564F1804685A377F
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_cffi_backend.cp39-win_amd64.pydexecutable
MD5:32BFF0D8BC6C0155FAF07411E7B61909
SHA256:D1B18696D319E027111069C5DB0EA995783C2752D54E9EB3A257A15BD031651F
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:80AB22C6D0250257B61B217822AA5D7C
SHA256:D56B63AEFEDC21372A5D75918032E98F3E4C564733D4838A5B442351E32A300B
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_ssl.pydexecutable
MD5:70014E88ECF3133B7BE097536F77B459
SHA256:D318795C98C5F3C127C8E47220A92ACBA0736DAF31BAB0DC9C7E6C3513BB2AA3
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\_socket.pydexecutable
MD5:CD56F508E7C305D4BFDEB820ECF3A323
SHA256:9E97B782B55400E5A914171817714BBBC713C0A396E30496C645FC82835E4B34
6884Tool.exeC:\Users\admin\AppData\Local\Temp\_MEI68842\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:6746E9CBC897101FD8CA22E42490614F
SHA256:81310FD7AAF3A8A280E6EFDDECD5A682C871FC6F5595A3BA131C9E60B58C80E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6344
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1944
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6344
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
232
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAOO2y%2FG5AVzGnYPFRYUTIU%3D
unknown
—
—
whitelisted
232
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6288
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6056
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4876
Bootstrapper.exe
172.67.203.125:443
getsolara.dev
CLOUDFLARENET
US
unknown
4876
Bootstrapper.exe
104.20.3.235:443
pastebin.com
CLOUDFLARENET
—
shared
4876
Bootstrapper.exe
128.116.119.3:443
clientsettings.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1944
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
getsolara.dev
  • 172.67.203.125
  • 104.21.93.27
unknown
pastebin.com
  • 104.20.3.235
  • 104.20.4.235
  • 172.67.19.24
shared
clientsettings.roblox.com
  • 128.116.119.3
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.nodejs.org
  • 104.20.23.46
  • 104.20.22.46
whitelisted
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Solara.exe