File name:

Game.exe

Full analysis: https://app.any.run/tasks/c6d992af-0e6d-4541-b443-cd9da30a9f04
Verdict: Malicious activity
Analysis date: June 16, 2025, 02:41:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

BD1C84F2314FD05DBFFBA3C99E55490E

SHA1:

E42C1021124E75FDC9115E624D689278CBC8BF48

SHA256:

7D6E8B5F2CDDBF1BCF1D7FC00F813816AAAB8B8FC47E82E9CB9918032BCDDA50

SSDEEP:

3072:2IYpGMuqWDzyUExux6pDFEQ/8qLUeM6OPdOwYQF6GnFO+Ieu:2/pzWDzYxuxYD+Q/eN6O1Owjn5Ieu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5552)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5552)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)

    • Starts itself from another location

      • Game.exe (PID: 6536)

    • Executable content was dropped or overwritten

      • Game_patch-run.exe (PID: 3872)
      • Game.exe (PID: 6536)

    • Executes application which crashes

      • Game.exe (PID: 2780)

    • Starts CMD.EXE for commands execution

      • Game_patch-run.exe (PID: 3872)
      • cmd.exe (PID: 5928)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 5928)
      • cmd.exe (PID: 6672)

    • The process creates files with name similar to system file names

      • Game_patch-run.exe (PID: 3872)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Game_patch-run.exe (PID: 3872)

    • Application launched itself

      • cmd.exe (PID: 5928)

    • Executing commands from a ".bat" file

      • Game_patch-run.exe (PID: 3872)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 5928)

    • The process executes Powershell scripts

      • cmd.exe (PID: 5928)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 5928)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5928)

    • Removes files via Powershell

      • powershell.exe (PID: 1204)

    • Manipulates environment variables

      • powershell.exe (PID: 1204)
      • powershell.exe (PID: 6140)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 5552)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 5928)

    • Renames file via Powershell

      • powershell.exe (PID: 6140)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 5552)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5928)

    • The process executes JS scripts

      • cmd.exe (PID: 5928)

  • INFO

    • Checks supported languages

      • Game.exe (PID: 6536)
      • Game.exe (PID: 2780)
      • Game_patch-run.exe (PID: 3872)

    • Create files in a temporary directory

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)

    • Reads the computer name

      • Game_patch-run.exe (PID: 3872)
      • Game.exe (PID: 2780)
      • Game.exe (PID: 6536)

    • Process checks computer location settings

      • Game_patch-run.exe (PID: 3872)
      • Game.exe (PID: 6536)

    • Reads the machine GUID from the registry

      • Game.exe (PID: 2780)

    • Checks proxy server information

      • WerFault.exe (PID: 6772)

    • Reads the software policy settings

      • WerFault.exe (PID: 6772)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6772)
      • Game_patch-run.exe (PID: 3872)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5764)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4880)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5552)

    • Manual execution by a user

      • msedge.exe (PID: 2368)

    • Application launched itself

      • msedge.exe (PID: 7056)
      • msedge.exe (PID: 5628)
      • msedge.exe (PID: 2368)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
45
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start game.exe game_patch-run.exe game.exe werfault.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs reg.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs game.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Users\admin\AppData\Local\Temp\Game.exe" C:\Users\admin\AppData\Local\Temp\Game.exe—explorer.exe
User:
admin
Company:
HP Inc
Integrity Level:
MEDIUM
Description:
HP.OneDriver.V4.PrinterExtension
Exit code:
3221226540
Version:
1.8.0.
Modules
Images
c:\users\admin\appdata\local\temp\game.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3376,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132reg.exe import C:\Users\admin\AppData\Local\Temp\temp_cleanup.ico /reg:64 C:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1204powershell -NoProfile -Command "foreach ($item in @(\"$env:LOCALAPPDATA\DiagnosticsNET\configuration.ps1\", \"$env:LOCALAPPDATA\DiagnosticsNET\update.vbs\", \"$env:LOCALAPPDATA\DiagnosticsNET\updater.vbs\", \"$env:LOCALAPPDATA\DiagnosticsNET\cache.ps1\", \"$env:LOCALAPPDATA\UpdatesWin\update.ps1\", \"$env:LOCALAPPDATA\UpdatesWin\updater.ps1\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1488"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2692,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3616,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5536,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --disable-quic --flag-switches-end --do-not-de-elevate --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2025-06X&u=9yodcgrwprbsnuyydexaueoeohwzokfxC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2452,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2512powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
40 684
Read events
40 636
Write events
45
Delete events
3

Modification events

(PID) Process:(6772) WerFault.exeKey:\REGISTRY\A\{f5621cec-41f8-0946-ccbe-010958e15545}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(6772) WerFault.exeKey:\REGISTRY\A\{f5621cec-41f8-0946-ccbe-010958e15545}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(6772) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
54844F6800000000
(PID) Process:(6772) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
0B61170000000000
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:Flags
Value:
14089087
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:AcctUId
Value:
0x000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:RoamingCount
Value:
0
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:SslClientCertReference
Value:
MY;User;0000000000000000000000000000000000000000
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:ProtoVer
Value:
1.2
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:EnrollmentState
Value:
1
Executable files
4
Suspicious files
236
Text files
137
Unknown types
19

Dropped files

PID
Process
Filename
Type
6772WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Game.exe_e6159ebf926c70ee51b3becda91393bfb8c3a_ec47739b_6f88c192-2adf-4916-9d48-7ce6a8d0fbc5\Report.wer —
MD5:—
SHA256:—
6772WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Game.exe.2780.dmp —
MD5:—
SHA256:—
6536Game.exeC:\Users\admin\AppData\Local\Temp\nst5804.tmpbinary
MD5:8F4E25C081A4C100773D44F32F4C6B9B
SHA256:CDD416EEAF0BCA7A79835390B140EDAA8CB37957B443DCD72CD3DC7377983501
6772WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6013.tmp.xmlxml
MD5:0D41B56E1E926213FDD11885F11FC2E5
SHA256:A2D08B0693590BC4AA5CCDD332BE2325F0203885071A13436FA00CAE99E3AD4B
3872Game_patch-run.exeC:\Users\admin\AppData\Local\Temp\Game.exeexecutable
MD5:C2F26DCF03CE79D120884CB0EC4B8090
SHA256:8A191BE25D13DDC8EDB54BA5FBD8D19B9F2CC6D7EE6471190C8E641C88189C2B
6772WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvehiv
MD5:DA6787AA92B233498FF4D3E8EFABD7BD
SHA256:40C3877394D440DA2409268FC9D0B5E2052FAEC53BF68F77DB515009BB6F1D3D
6772WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:9CEA06B7C2446D11612F485A25AD5439
SHA256:72425078E3401E7B9A829620EEFDB926302027FF15837BA1D03A74C5EBF640A3
6772WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:5B63C0144C61100C949E65C9B4C7B790
SHA256:51E7A9D4403161514027724D012C19E4717FD92CC87B31049944A37B40228B8E
6772WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5FC4.tmp.WERInternalMetadata.xmlxml
MD5:73ABDE4A51F34B61FC17766E2D8AF430
SHA256:992184C22CC35A2BF3A3D92C2E4C6958205E80C6CD04D4A8A26B3D762A2A4316
6772WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:71979940DF8EB60F0809C77690B2C426
SHA256:A198A376086E3D918E9A39CAA9ADC62E2826F29A00A1ECCB9663265110321B23
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
72
DNS requests
74
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6772
WerFault.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6772
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1336
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4456
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:srJhk23oPnT_vhIVH7ttX9xTybssaViaVjtOkStFdwU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3388
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3388
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5708
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6772
WerFault.exe
52.182.143.212:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6772
WerFault.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6772
WerFault.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1336
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
watson.events.data.microsoft.com
  • 52.182.143.212
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.4
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.3
  • 40.126.32.72
  • 20.190.160.2
  • 20.190.160.64
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted

Threats

PID
Process
Class
Message
4456
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
4456
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Game.exe