EchoTrail

Claude 3.6556.2

by Anthropic, PBCinstaller signed by Anthropic, PBCValid

Sources: observed in the EchoTrail lab on Windows 11 on November 12, 2026.

The install

Installer
claude-20c019a1e61fa5b687616af57d31f97bb3181723.exe
Installer type
squirrel
Installed through
a type-detected silent switch
Install directory
C:\Users\lab\AppData\Local\AnthropicClaude
Launched
claude.exe
Windows
Windows 11
Date
November 12, 2026
Executables dropped
14

installer sha256 945082290478e5c668e8aaa25a392e1cd129e6219173e907b7ff1f7f99ded45e

The lab used Claude for 2 minutes, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Claude's own windows.

Claude 3.6556.2: First window
First window. Claude for Windows welcome screen with a Get started button.
Claude 3.6556.2: Main window
Main window. The Help submenu is open, showing Claude Help, Keyboard Shortcuts, Troubleshooting, Get Support, a greyed Downloading Update item and About Claude.
Claude 3.6556.2: First window
First window. Claude sign-in screen with Google and email options, plus a hamburger Menu button at top left.
Claude 3.6556.2: Worth a look
Worth a look. The About Claude dialog is open showing version 3.6556.2 over the sign-in screen.

What it dropped

Executables

  • claude.exesigned by CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValidran during the lab session
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\claude.exe
    sha256 3e25bd63028e315b3dd1f375e02e5958a6cb6567d885e6005a517d2394686afa
  • dxcompiler.dllsigned by CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\dxcompiler.dll
    sha256 4578bcad976c1026ce814c7b9c0f7dd49e311e12d8a7140cb23c1c68d8fb3a27
  • github-mcp-server.exe
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\resources\app.asar.unpacked\resources\github-mcp\github-mcp-server.exe
    sha256 3a88ce0113bdb884101e104ffdd9dc9773cff39720db1ddfaa5db311acd1c327
  • d3dcompiler_47.dllsigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\d3dcompiler_47.dll
    sha256 444c2be25d3db314ea5336e7cfaa88ac33225b4289eabbb54124410e31a9e7a5
  • msalruntime.dll
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\resources\app.asar.unpacked\resources\office365-mcp\msalruntime.dll
    sha256 0b05586e428d7a5cfb405dfd16ab07ff426b577ee479249d52324e1d0f1c30df
  • ffmpeg.dllsigned by CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=USValid
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\ffmpeg.dll
    sha256 2c0711653018d544ff1a2ec5075bb60331c2f66889762a830d414abf82fd3063
  • claude-ssh-askpass.exe
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\resources\claude-ssh-askpass.exe
    sha256 84c41386f8d0e230252600990c1d6c83a189855a2107a077f91b136d05142430
  • claude-ssh-broker.exe
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\resources\claude-ssh-broker.exe
    sha256 56d222f40c95c93e9f843a36cff3c986ee062584373a51e8e14f3764359270ad
  • claude-ssh-proxy.exe
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\resources\claude-ssh-proxy.exe
    sha256 abfa2b487d5059c6e7d292bd8d28d92b8fa38f8f1e1992de5780d521487b3720
  • update.exefile_missingran during the lab session
    C:\Users\lab\AppData\Local\SquirrelTemp\Update.exe
    sha256 d2d57d8e997fd4cb650799f5a4b010c2865427e1a81003a0c30061efc849044a
  • update.exefile_missingran during the lab session
    C:\Users\lab\AppData\Local\AnthropicClaude\Update.exe
    sha256 d2d57d8e997fd4cb650799f5a4b010c2865427e1a81003a0c30061efc849044a
  • dxil.dllsigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\dxil.dll
    sha256 494c62c5d5ab60c3627cb6a7330ac496ef7e4b62b1d17ad5d66ded7984d0d719
  • chrome-native-host.exe
    C:\Users\lab\AppData\Local\AnthropicClaude\app-3.6556.2\resources\chrome-native-host.exe
    sha256 436f8f6e2743632f2a1ca8f3da0c999bdf348a9a5bfc52f01cd7ed0375e08b6a
  • claude.exefile_changedran during the lab session
    C:\Users\lab\AppData\Local\AnthropicClaude\claude.exe
    sha256 c2a08c35868d22866046eea0793a2be81103dbcb226e6f69e2e7c5fee317f093

What it talked to

Destinations

  • 160.79.104.10:443asked by claude.exe18 connections
  • 104.19.229.21:443asked by claude.exe5 connections
  • 160.79.104.10:443asked by update.exe3 connections
  • 34.149.66.163:443asked by claude.exe3 connections
  • 104.18.13.205:443asked by claude.exe2 connections
  • 160.79.104.10:443asked by claude.exe2 connections
  • 34.54.194.141:443asked by claude.exe2 connections
  • 104.18.12.205:443asked by claude.exe
  • 142.250.115.84:443asked by claude.exe
  • 34.54.194.141:443asked by claude.exe
  • 35.190.46.17:443asked by update.exe

DNS

  • api.anthropic.comasked by update.exe
  • claude.aiasked by update.exe
  • downloads.claude.aiasked by update.exe