File name:

2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe

Full analysis: https://app.any.run/tasks/8059f785-0aca-43c1-a0fe-6bb235dc57c6
Verdict: Malicious activity
Threats:

Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 16:25:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
cobaltstrike
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

6DC9EEAA01A79D8CA32CB76308DB82C1

SHA1:

95DD4407F1E33C9569196A7DC1A1C7A2EDBDF4C7

SHA256:

2A46CB0BCADDF532D54171C0466E6FE92D4FB3ECD7CD9E1BC70160DBB1952D53

SSDEEP:

49152:Q/4cQIiElP/DTtUQlzmwuz8YrtYKAx/9M0oryIOJXoeOjRyt44IrXhdvF3GB2oPd:Q/iYl3DCazmwuxC53oTjRyS4gNoZ/jT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • COBALTSTRIKE has been detected (YARA)

      • logi_crashpad_handler.exe (PID: 1188)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • logi_crashpad_handler.exe (PID: 1188)

    • Process requests binary or script from the Internet

      • logi_crashpad_handler.exe (PID: 1188)

    • Executes application which crashes

      • logi_crashpad_handler.exe (PID: 1188)

    • Starts itself from another location

      • 2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe (PID: 3140)

    • Reads security settings of Internet Explorer

      • logi_crashpad_handler.exe (PID: 1188)

    • Executable content was dropped or overwritten

      • 2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe (PID: 3140)

    • Reads Microsoft Outlook installation path

      • logi_crashpad_handler.exe (PID: 1188)

  • INFO

    • Checks supported languages

      • 2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe (PID: 3140)
      • logi_crashpad_handler.exe (PID: 1188)

    • The sample compiled with english language support

      • 2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe (PID: 3140)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 644)
      • WerFault.exe (PID: 3192)
      • WerFault.exe (PID: 4008)
      • WerFault.exe (PID: 1348)
      • WerFault.exe (PID: 5776)
      • WerFault.exe (PID: 1388)
      • WerFault.exe (PID: 5416)
      • WerFault.exe (PID: 1164)

    • Reads the machine GUID from the registry

      • logi_crashpad_handler.exe (PID: 1188)

    • Reads the computer name

      • logi_crashpad_handler.exe (PID: 1188)

    • Checks proxy server information

      • slui.exe (PID: 1096)

    • Reads the software policy settings

      • slui.exe (PID: 1096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(1188) logi_crashpad_handler.exe
C2 (2)154.204.35.241/js/PromotionBanner.Main.min.js
www.baidu.com/js/PromotionBanner.Main.min.js
BeaconTypeHTTP
Port80
SleepTime10000
MaxGetSize2799845
Jitter37
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJtPDKStCYhFR4nJhAWmPf5Kcf oq3dUBbj1huy9IMMrW24Z3kbDVNTl1vzKBpK+Efi4B+dKjw1ShWfbrVM0yq0vOFk 8ZDpD+/QVw2v0+4xgFGJYSzGUcSqBENOt5G1vRsHFjjDAw9NbudG1JioLYg/Sqo+ T4vKDG57O2hdlUyFKwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTo00000000000000000000000000000000
Spawnto_x86%windir%\syswow64\dllhost.exe
Spawnto_x64%windir%\sysnative\dllhost.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark987654321
bStageCleanupTrue
bCFGCautionFalse
UserAgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
HttpPostUri/v4/api/selection
Malleable_C2_InstructionsRemove 1 bytes at the end, Remove 2310 bytes from the beginning, Base64 URL-safe decode, XOR mask w/ random key
HttpGet_Metadata
ConstHeaders (4)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Sec-Fetch-Dest: script
DNT: 1
Accept-Encoding: gzip, deflate, br
SessionId (3)base64url
prepend: v=
header: Cookie
HttpPost_Metadata
ConstHeaders (4)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Sec-Fetch-Dest: script
DNT: 1
Accept-Encoding: gzip, deflate, br
SessionId (3)mask
base64url
parameter: scs_ecsFlightId
Output (4)mask
base64url
prepend: error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=
print
SSH_BannerHost: www.baidu.com
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0005800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0005800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXFalse
bProcInject_UseRWXFalse
bProcInject_MinAllocSize17500
ProcInject_PrependAppend_x869090..
ProcInject_PrependAppend_x649090..
ProcInject_Stub0311c6962199780fcc2d538504695afb
ProcInject_AllocationMethodNtMapViewOfSection
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:07:23 23:08:14+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 1407488
InitializedDataSize: 1076736
UninitializedDataSize: -
EntryPoint: 0x13997c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 109.0.0.0
ProductVersionNumber: 109.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Chromium Embedded Framework (CEF) Dynamic Link Library
FileVersion: 109.0.0-5414-shared-texture.2727+gc81f89b+chromium-109.0.5414.120
InternalName: libcef
LegalCopyright: Copyright (C) 2024 The Chromium Embedded Framework Authors
OriginalFileName: libcef.dll
ProductName: Chromium Embedded Framework (CEF) Dynamic Link Library
ProductVersion: 109.0.0-5414-shared-texture.2727+gc81f89b+chromium-109.0.5414.120
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe #COBALTSTRIKE logi_crashpad_handler.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
644C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 708C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptsp.dll
1096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1164C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 772C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
1188C:\LGHUB\system_tray\logi_crashpad_handler.exe --crashpad errorC:\LGHUB\system_tray\logi_crashpad_handler.exe
2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Chromium Embedded Framework (CEF) Dynamic Link Library
Version:
109.0.0-5414-shared-texture.2727+gc81f89b+chromium-109.0.54
Modules
Images
c:\lghub\system_tray\logi_crashpad_handler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
CobalStrike
(PID) Process(1188) logi_crashpad_handler.exe
C2 (2)154.204.35.241/js/PromotionBanner.Main.min.js
www.baidu.com/js/PromotionBanner.Main.min.js
BeaconTypeHTTP
Port80
SleepTime10000
MaxGetSize2799845
Jitter37
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJtPDKStCYhFR4nJhAWmPf5Kcf oq3dUBbj1huy9IMMrW24Z3kbDVNTl1vzKBpK+Efi4B+dKjw1ShWfbrVM0yq0vOFk 8ZDpD+/QVw2v0+4xgFGJYSzGUcSqBENOt5G1vRsHFjjDAw9NbudG1JioLYg/Sqo+ T4vKDG57O2hdlUyFKwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTo00000000000000000000000000000000
Spawnto_x86%windir%\syswow64\dllhost.exe
Spawnto_x64%windir%\sysnative\dllhost.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark987654321
bStageCleanupTrue
bCFGCautionFalse
UserAgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
HttpPostUri/v4/api/selection
Malleable_C2_InstructionsRemove 1 bytes at the end, Remove 2310 bytes from the beginning, Base64 URL-safe decode, XOR mask w/ random key
HttpGet_Metadata
ConstHeaders (4)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Sec-Fetch-Dest: script
DNT: 1
Accept-Encoding: gzip, deflate, br
SessionId (3)base64url
prepend: v=
header: Cookie
HttpPost_Metadata
ConstHeaders (4)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Sec-Fetch-Dest: script
DNT: 1
Accept-Encoding: gzip, deflate, br
SessionId (3)mask
base64url
parameter: scs_ecsFlightId
Output (4)mask
base64url
prepend: error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=
print
SSH_BannerHost: www.baidu.com
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0005800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0005800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXFalse
bProcInject_UseRWXFalse
bProcInject_MinAllocSize17500
ProcInject_PrependAppend_x869090..
ProcInject_PrependAppend_x649090..
ProcInject_Stub0311c6962199780fcc2d538504695afb
ProcInject_AllocationMethodNtMapViewOfSection
1348C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 796C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\policymanager.dll
c:\windows\system32\msvcp110_win.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\dsreg.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\profapi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\version.dll
c:\windows\system32\verifier.dll
1388C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 1156C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
3140"C:\Users\admin\Desktop\2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe" C:\Users\admin\Desktop\2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Chromium Embedded Framework (CEF) Dynamic Link Library
Exit code:
0
Version:
109.0.0-5414-shared-texture.2727+gc81f89b+chromium-109.0.54
Modules
Images
c:\users\admin\desktop\2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3192C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 1092C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
4008C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 736C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
5416C:\WINDOWS\system32\WerFault.exe -u -p 1188 -s 600C:\Windows\System32\WerFault.exe—logi_crashpad_handler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
Total events
17 571
Read events
17 571
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
24
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5416WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logi_crashpad_ha_dee239711d4e1fa6ad923cb16c633f90e99d95_f91a3427_cecc6e32-9d6a-49d2-a5e8-393a55b81005\Report.wer —
MD5:—
SHA256:—
4008WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logi_crashpad_ha_dee239711d4e1fa6ad923cb16c633f90e99d95_f91a3427_e122cb6c-2051-4899-8270-14089598f96f\Report.wer —
MD5:—
SHA256:—
1164WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logi_crashpad_ha_dee239711d4e1fa6ad923cb16c633f90e99d95_f91a3427_2b2509a1-95d8-4748-a7b6-44e1ca2c5c2d\Report.wer —
MD5:—
SHA256:—
1348WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logi_crashpad_ha_dee239711d4e1fa6ad923cb16c633f90e99d95_f91a3427_54c2d76c-c3aa-463c-ad89-3ef8444da227\Report.wer —
MD5:—
SHA256:—
31402a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exeC:\LGHUB\system_tray\logi_crashpad_handler.exeexecutable
MD5:6DC9EEAA01A79D8CA32CB76308DB82C1
SHA256:2A46CB0BCADDF532D54171C0466E6FE92D4FB3ECD7CD9E1BC70160DBB1952D53
5776WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logi_crashpad_ha_dee239711d4e1fa6ad923cb16c633f90e99d95_f91a3427_caa33963-fb72-4e1d-ad6d-d3c40b16e8ac\Report.wer —
MD5:—
SHA256:—
5416WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC9EA.tmp.WERInternalMetadata.xmlbinary
MD5:F8BA9931D2B111AD8AF6F78917AFD979
SHA256:9F261B15CF1AB0D68B26E9BE8DB2897A4E32EFABA1209BAD430B5A8223936399
4008WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCD85.tmp.xmlxml
MD5:CCBF4E21D761F0BA2ED112263952CB06
SHA256:E841235AB39C0DCE502E680D5D0F974215A4836DAD400DA1471E79DB21A6F52B
4008WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\logi_crashpad_handler.exe(1).1188.dmpbinary
MD5:138DDB6824B61F65944BE0B8E00F3D86
SHA256:3DEA284003A1A64DDA6368CE9450E9BDFCDF5F6277C8BFD8C85BDA791F8629B1
5416WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC8D0.tmp.dmpbinary
MD5:588C295EFE1DD7AC79A3D59FE638AFE2
SHA256:1771C75D9E5101FB3F9935F93808923FD33377EC7400A41E2F44BC6345C328A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
44
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1188
logi_crashpad_handler.exe
GET
200
154.204.35.241:80
http://www.baidu.com/js/PromotionBanner.Main.min.js
unknown
—
—
whitelisted
1188
logi_crashpad_handler.exe
GET
404
103.235.46.102:80
http://www.baidu.com/js/PromotionBanner.Main.min.js
unknown
—
—
whitelisted
6388
SIHClient.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6388
SIHClient.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6388
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6388
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
1188
logi_crashpad_handler.exe
GET
200
154.204.35.241:80
http://www.baidu.com/js/PromotionBanner.Main.min.js
unknown
—
—
whitelisted
1188
logi_crashpad_handler.exe
GET
200
154.204.35.241:80
http://www.baidu.com/js/PromotionBanner.Main.min.js
unknown
—
—
whitelisted
6388
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
1188
logi_crashpad_handler.exe
GET
200
154.204.35.241:80
http://www.baidu.com/js/PromotionBanner.Main.min.js
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1188
logi_crashpad_handler.exe
154.204.35.241:80
—
SonderCloud Limited
HK
malicious
1188
logi_crashpad_handler.exe
103.235.46.102:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
whitelisted
6388
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6388
SIHClient.exe
23.216.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6388
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6388
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
www.baidu.com
  • 103.235.46.102
  • 103.235.46.115
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
crl.microsoft.com
  • 23.216.77.38
  • 23.216.77.17
  • 23.216.77.16
  • 23.216.77.21
  • 23.216.77.25
  • 23.216.77.35
  • 23.216.77.18
  • 23.216.77.20
  • 23.216.77.26
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2a46cb0bcaddf532d54171c0466e6fe92d4fb3ecd7cd9e1bc70160dbb1952d53.exe