File name:

shellcode.sc

Full analysis: https://app.any.run/tasks/a38ce16e-56b8-4368-905a-722d85e663bf
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 24, 2025, 11:34:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
cobaltstrike
backdoor
golang
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (65536), with no line terminators
MD5:

4ACD445EFE694988A8245238C4725BE8

SHA1:

FFE320458DFC147B872082998093F09FE7C00B35

SHA256:

C85B9F369C9FC725A1571E5F3C0F0BFEEF4269B5E0223A9016655DEEAD649332

SSDEEP:

12288:R6Q/3MESXmFSMrUUAmr1nXC1DnaP8NX1eJXnxEgliXdrLq9ENwwRkfp3axe8w9Hg:6xhgfWvW+COhHLpBmEPxVY936RfguEm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • COBALTSTRIKE has been detected (YARA)

      • cobalt.exe (PID: 5668)
      • explorer.exe (PID: 6944)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • mshta.exe (PID: 7344)

    • COBALTSTRIKE has been detected (SURICATA)

      • cobalt.exe (PID: 5668)

    • Uses sleep, probably for evasion (MACROS)

      • EXCEL.EXE (PID: 7412)

    • Uses base64 encoding (SCRIPT)

      • mshta.exe (PID: 7344)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cobalt.exe (PID: 5668)
      • GameBar.exe (PID: 1052)

    • Connects to unusual port

      • cobalt.exe (PID: 5668)

    • Creates XML DOM element (SCRIPT)

      • mshta.exe (PID: 7344)

    • Executes application which crashes

      • explorer.exe (PID: 6944)

    • Starts CMD.EXE for commands execution

      • URLMonitor64.exe (PID: 2600)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 2320)

    • Sets XML DOM element text (SCRIPT)

      • mshta.exe (PID: 7344)

  • INFO

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 6668)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7944)
      • WinRAR.exe (PID: 5132)

    • Manual execution by a user

      • WinRAR.exe (PID: 7944)
      • apateDNS.exe (PID: 8112)
      • apateDNS.exe (PID: 8064)
      • cobalt.exe (PID: 5668)
      • cobi.exe (PID: 7292)
      • mshta.exe (PID: 7344)
      • cobalt.exe (PID: 1168)
      • URLMonitor64.exe (PID: 2600)
      • WinRAR.exe (PID: 5132)
      • URLMonitor64.exe (PID: 5036)
      • mshta.exe (PID: 7364)

    • Checks supported languages

      • apateDNS.exe (PID: 8112)
      • cobalt.exe (PID: 5668)
      • GameBar.exe (PID: 1052)
      • cobi.exe (PID: 7292)

    • Reads the computer name

      • apateDNS.exe (PID: 8112)
      • cobalt.exe (PID: 5668)
      • cobi.exe (PID: 7292)
      • GameBar.exe (PID: 1052)

    • Reads the machine GUID from the registry

      • apateDNS.exe (PID: 8112)
      • cobalt.exe (PID: 5668)

    • Checks proxy server information

      • cobalt.exe (PID: 5668)
      • explorer.exe (PID: 6944)
      • mshta.exe (PID: 7344)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 6944)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7344)

    • Application based on Golang

      • cobalt.exe (PID: 5668)

    • Uses BITSADMIN.EXE

      • cmd.exe (PID: 660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(5668) cobalt.exe
C260.205.253.112:9955/MHRv
HeadersUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;PTBR)
C2 (1)60.205.253.112/dpixel
BeaconTypeHTTP
Port9955
SleepTime60000
MaxGetSize1048576
Jitter0
PublicKey-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnxgD5MTdqZtDvQqhtVKyDkvw9 Nymk+7AgP4OICZsKTxHpxOscWTRkK+kc+fz++rtPFtCjkeXnbASNDI47HfGzkUwf 92qrb4wfA/Vk12YPGGd2e3LzJmfcNsiVdjIT7h1Fnk/E1nS0SvFVou+OrkAWeLRv drnTxjIHCvPxqUVfOwIDAQAB -----END PUBLIC KEY-----
DNS_strategyround-robin
DNS_strategy_rotate_seconds-1
DNS_strategy_fail_x-1
DNS_strategy_fail_seconds-1
SpawnTod7a9ca15a07f82bfd3b63020da38aa16
Spawnto_x86%windir%\syswow64\rundll32.exe
Spawnto_x64%windir%\sysnative\rundll32.exe
CryptoScheme0
HttpGet_VerbGET
HttpPost_VerbPOST
HttpPostChunk0
Watermark391144938
bStageCleanupFalse
bCFGCautionFalse
UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)
HttpPostUri/submit.php
HttpGet_Metadata
SessionId (2)base64
header: Cookie
HttpPost_Metadata
ConstHeaders (1)Content-Type: application/octet-stream
SessionId (1)parameter: id
Output (1)print
bUsesCookies0001
Proxy_BehaviorUse IE settings
tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
KillDate0-0-0
bProcInject_StartRWXTrue
bProcInject_UseRWXTrue
bProcInject_MinAllocSize0
ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000...
ProcInject_Stubb50b86d735412685eb6044ad8d01781c
ProcInject_AllocationMethodVirtualAllocEx
(PID) Process(6944) explorer.exe
C2192.168.195.128:443/YAkX
HeadersUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt; DTS Agent
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
33
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start openwith.exe no specs sppextcomobj.exe no specs slui.exe no specs winrar.exe rundll32.exe no specs apatedns.exe no specs apatedns.exe #COBALTSTRIKE cobalt.exe conhost.exe no specs gamebarpresencewriter.exe no specs gamebar.exe no specs slui.exe no specs cobi.exe no specs conhost.exe no specs #COBALTSTRIKE explorer.exe mshta.exe no specs excel.exe werfault.exe no specs winrar.exe urlmonitor64.exe no specs urlmonitor64.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs bitsadmin.exe no specs mshta.exe no specs excel.exe no specs cobalt.exe no specs conhost.exe no specs gamebarpresencewriter.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\windows\system32\cmd.exe" /c bitsadmin /util /setieproxy localsystem MANUAL_PROXY localhost:8080 ""C:\Windows\System32\cmd.exe—URLMonitor64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1052"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mcaC:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\windowsapps\microsoft.xboxgamingoverlay_2.34.28001.0_x64__8wekyb3d8bbwe\gamebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1088"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServerC:\Windows\System32\GameBarPresenceWriter.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Gamebar Presence Writer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\gamebarpresencewriter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1168"C:\Users\admin\Desktop\cobalt.exe" C:\Users\admin\Desktop\cobalt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\cobalt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\wininet.dll
2148C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2320"C:\windows\system32\cmd.exe" /c netsh winhttp set proxy localhost:8080C:\Windows\System32\cmd.exe—URLMonitor64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2600"C:\Users\admin\Desktop\URLMonitor64.exe" C:\Users\admin\Desktop\URLMonitor64.exe
explorer.exe
User:
admin
Company:
KahuSecurity
Integrity Level:
HIGH
Description:
URLMonitor
Version:
0.1.0.0
Modules
Images
c:\users\admin\desktop\urlmonitor64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2896netsh winhttp set proxy localhost:8080C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3012bitsadmin /util /setieproxy localsystem MANUAL_PROXY localhost:8080 ""C:\Windows\System32\bitsadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
BITS administration utility
Exit code:
0
Version:
7.8.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bitsadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5036"C:\Users\admin\Desktop\URLMonitor64.exe" C:\Users\admin\Desktop\URLMonitor64.exe—explorer.exe
User:
admin
Company:
KahuSecurity
Integrity Level:
MEDIUM
Description:
URLMonitor
Exit code:
3221226540
Version:
0.1.0.0
Modules
Images
c:\users\admin\desktop\urlmonitor64.exe
c:\windows\system32\ntdll.dll
Total events
19 640
Read events
19 412
Write events
206
Delete events
22

Modification events

(PID) Process:(7944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7944) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1052) GameBar.exeKey:\REGISTRY\A\{2feab7d7-4a91-f422-09ec-349685e29c33}\LocalState
Operation:writeName:CurrentDisplayMonitor
Value:
670061006D0065000000416271E39FCCDB01
(PID) Process:(1052) GameBar.exeKey:\REGISTRY\A\{2feab7d7-4a91-f422-09ec-349685e29c33}\LocalState
Operation:writeName:InstalledVersionMajor
Value:
020054B76EE39FCCDB01
(PID) Process:(1052) GameBar.exeKey:\REGISTRY\A\{2feab7d7-4a91-f422-09ec-349685e29c33}\LocalState
Operation:writeName:InstalledVersionMinor
Value:
220054B76EE39FCCDB01
(PID) Process:(1052) GameBar.exeKey:\REGISTRY\A\{2feab7d7-4a91-f422-09ec-349685e29c33}\LocalState
Operation:writeName:InstalledVersionBuild
Value:
616D6EEF6EE39FCCDB01
(PID) Process:(1052) GameBar.exeKey:\REGISTRY\A\{2feab7d7-4a91-f422-09ec-349685e29c33}\LocalState
Operation:writeName:InstalledVersionRevision
Value:
00006EEF6EE39FCCDB01
(PID) Process:(1052) GameBar.exeKey:\REGISTRY\A\{2feab7d7-4a91-f422-09ec-349685e29c33}\LocalState
Operation:writeName:PreviousAppTerminationFromSuspended
Value:
00B6F16EE39FCCDB01
Executable files
3
Suspicious files
9
Text files
904
Unknown types
0

Dropped files

PID
Process
Filename
Type
7224WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_d669974e731581fcd4a9c8ca912b755dea9f012_4a37867f_b5764362-1c7a-4763-8047-207137d8073b\Report.wer —
MD5:—
SHA256:—
7944WinRAR.exeC:\Users\admin\Desktop\apateDNS\apateDNS.exeexecutable
MD5:EEE67B77EE2600605F524EE628E2C230
SHA256:8FC71012A0C009149AD07E32234B91AB5F782B154E0487E353C70330076960DA
7412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100071v0.xmlxml
MD5:3DF0BABC8132291994D448B40582DB90
SHA256:6FB9BDDDA6B632428391FAFE9CE78D58CD0986B6571D8BB4C9691496070F3F19
7224WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER35E.tmp.dmpbinary
MD5:31E5B67DA2A556561B05DE0F76AB2BFE
SHA256:3B49A902DF693FEE1B2E3932B6641A3065CCE038A070A21B4682497F12C750C1
7944WinRAR.exeC:\Users\admin\Desktop\apateDNS\README.pdfpdf
MD5:91C23506930C8D72B2CCB20C92002823
SHA256:B872CD82BA6DA1C45C43F446CF53B1875737D010038CCF8E27455BBFE93F396A
7412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:7EDADB8DAF846D6A4D61CA8BA150722F
SHA256:0B8DBF7DCA66D808995CB5288709A81E8EE201F454F44D928BE9669C1F6510B3
7344mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLtext
MD5:5433EAB10C6B5C6D55B7CBD302426A39
SHA256:23DBF7014E99E93AF5F2760F18EE1370274F06A453145C8D539B66D798DAD131
7344mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTDxml
MD5:90BE2701C8112BEBC6BD58A7DE19846E
SHA256:644FBCDC20086E16D57F31C5BAD98BE68D02B1C061938D2F5F91CBE88C871FBF
7412EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:B97FC45E5D6A7C4FBCF113D4B6A18AE2
SHA256:83953E096661605BD1B6BF435F5A28355F3842BC8D28E00EAF90C6ADD775D1CA
7344mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.baktext
MD5:7050D5AE8ACFBE560FA11073FEF8185D
SHA256:CB87767C4A384C24E4A0F88455F59101B1AE7B4FB8DE8A5ADB4136C5F7EE545B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
134
TCP/UDP connections
168
DNS requests
14
Threats
253

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5668
cobalt.exe
GET
200
60.205.253.112:9955
http://60.205.253.112:9955/dpixel
unknown
—
—
unknown
7784
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7784
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5668
cobalt.exe
GET
200
60.205.253.112:9955
http://60.205.253.112:9955/MHRv
unknown
—
—
unknown
5668
cobalt.exe
GET
200
60.205.253.112:9955
http://60.205.253.112:9955/dpixel
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.29
  • 23.216.77.19
  • 23.216.77.21
  • 23.216.77.12
  • 23.216.77.10
  • 23.216.77.20
  • 23.216.77.23
  • 23.216.77.17
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.65
  • 20.190.160.64
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
otelrules.azureedge.net
  • 13.107.246.45
whitelisted

Threats

PID
Process
Class
Message
5668
cobalt.exe
A Network Trojan was detected
ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1
5668
cobalt.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
5668
cobalt.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
5668
cobalt.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
5668
cobalt.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
5668
cobalt.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
5668
cobalt.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
5668
cobalt.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
5668
cobalt.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
5668
cobalt.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shellcode.sc