File name:

Game.exe

Full analysis: https://app.any.run/tasks/c6d992af-0e6d-4541-b443-cd9da30a9f04
Verdict: Malicious activity
Analysis date: June 16, 2025, 02:41:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

BD1C84F2314FD05DBFFBA3C99E55490E

SHA1:

E42C1021124E75FDC9115E624D689278CBC8BF48

SHA256:

7D6E8B5F2CDDBF1BCF1D7FC00F813816AAAB8B8FC47E82E9CB9918032BCDDA50

SSDEEP:

3072:2IYpGMuqWDzyUExux6pDFEQ/8qLUeM6OPdOwYQF6GnFO+Ieu:2/pzWDzYxuxYD+Q/eN6O1Owjn5Ieu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5552)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5552)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)

    • Reads security settings of Internet Explorer

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)

    • Starts itself from another location

      • Game.exe (PID: 6536)

    • Executes application which crashes

      • Game.exe (PID: 2780)

    • The process creates files with name similar to system file names

      • Game_patch-run.exe (PID: 3872)

    • Application launched itself

      • cmd.exe (PID: 5928)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5928)
      • Game_patch-run.exe (PID: 3872)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Game_patch-run.exe (PID: 3872)

    • Executing commands from a ".bat" file

      • Game_patch-run.exe (PID: 3872)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 5928)
      • cmd.exe (PID: 6672)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 5928)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 5928)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5928)

    • Removes files via Powershell

      • powershell.exe (PID: 1204)

    • Renames file via Powershell

      • powershell.exe (PID: 6140)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 5928)

    • The process executes Powershell scripts

      • cmd.exe (PID: 5928)

    • Manipulates environment variables

      • powershell.exe (PID: 1204)
      • powershell.exe (PID: 6140)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 5552)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 5552)

    • The process executes JS scripts

      • cmd.exe (PID: 5928)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5928)

  • INFO

    • Checks supported languages

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)
      • Game.exe (PID: 2780)

    • Create files in a temporary directory

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)

    • Reads the computer name

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)
      • Game.exe (PID: 2780)

    • Process checks computer location settings

      • Game.exe (PID: 6536)
      • Game_patch-run.exe (PID: 3872)

    • Creates files or folders in the user directory

      • Game_patch-run.exe (PID: 3872)
      • WerFault.exe (PID: 6772)

    • Reads the machine GUID from the registry

      • Game.exe (PID: 2780)

    • Checks proxy server information

      • WerFault.exe (PID: 6772)

    • Reads the software policy settings

      • WerFault.exe (PID: 6772)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5764)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4880)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2512)

    • Application launched itself

      • msedge.exe (PID: 7056)
      • msedge.exe (PID: 5628)
      • msedge.exe (PID: 2368)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5552)

    • Manual execution by a user

      • msedge.exe (PID: 2368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
45
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start game.exe game_patch-run.exe game.exe werfault.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs reg.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs game.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Users\admin\AppData\Local\Temp\Game.exe" C:\Users\admin\AppData\Local\Temp\Game.exe—explorer.exe
User:
admin
Company:
HP Inc
Integrity Level:
MEDIUM
Description:
HP.OneDriver.V4.PrinterExtension
Exit code:
3221226540
Version:
1.8.0.
Modules
Images
c:\users\admin\appdata\local\temp\game.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3376,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132reg.exe import C:\Users\admin\AppData\Local\Temp\temp_cleanup.ico /reg:64 C:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1204powershell -NoProfile -Command "foreach ($item in @(\"$env:LOCALAPPDATA\DiagnosticsNET\configuration.ps1\", \"$env:LOCALAPPDATA\DiagnosticsNET\update.vbs\", \"$env:LOCALAPPDATA\DiagnosticsNET\updater.vbs\", \"$env:LOCALAPPDATA\DiagnosticsNET\cache.ps1\", \"$env:LOCALAPPDATA\UpdatesWin\update.ps1\", \"$env:LOCALAPPDATA\UpdatesWin\updater.ps1\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1488"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2692,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3616,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5536,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --disable-quic --flag-switches-end --do-not-de-elevate --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2025-06X&u=9yodcgrwprbsnuyydexaueoeohwzokfxC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2452,i,18321373585827041490,5150705242761051638,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2512powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
40 684
Read events
40 636
Write events
45
Delete events
3

Modification events

(PID) Process:(6772) WerFault.exeKey:\REGISTRY\A\{f5621cec-41f8-0946-ccbe-010958e15545}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(6772) WerFault.exeKey:\REGISTRY\A\{f5621cec-41f8-0946-ccbe-010958e15545}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(6772) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
54844F6800000000
(PID) Process:(6772) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
0B61170000000000
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:Flags
Value:
14089087
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:AcctUId
Value:
0x000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:RoamingCount
Value:
0
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:SslClientCertReference
Value:
MY;User;0000000000000000000000000000000000000000
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:ProtoVer
Value:
1.2
(PID) Process:(1132) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:EnrollmentState
Value:
1
Executable files
4
Suspicious files
236
Text files
137
Unknown types
19

Dropped files

PID
Process
Filename
Type
6772WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Game.exe_e6159ebf926c70ee51b3becda91393bfb8c3a_ec47739b_6f88c192-2adf-4916-9d48-7ce6a8d0fbc5\Report.wer —
MD5:—
SHA256:—
6772WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Game.exe.2780.dmp —
MD5:—
SHA256:—
6536Game.exeC:\Users\admin\AppData\Local\Temp\Game_patch-run.exeexecutable
MD5:BD1C84F2314FD05DBFFBA3C99E55490E
SHA256:7D6E8B5F2CDDBF1BCF1D7FC00F813816AAAB8B8FC47E82E9CB9918032BCDDA50
6772WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5EBA.tmp.dmpdmp
MD5:DAD7255B2B1B05B1FD02E6A6E97019D4
SHA256:10D1BB9F602123078DAAB2792E41F96C67E79F5B223B8507F59F64EAF2D653EB
3872Game_patch-run.exeC:\Users\admin\AppData\Local\Features\x\manifest.jsonbinary
MD5:EAB4F28096B06044482BD3162986C702
SHA256:60987C1AF11463E775FDD41BFE3BAEA30F266829055FD962406F6857D45B6ACA
6772WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:0F7B8F6A846AA9CA52FA562DDDCDB5ED
SHA256:AFF90E65A81289B80D1FCC5E71B3D88E5D1AAFE22CE358EB6E28A56D1845263D
3872Game_patch-run.exeC:\Users\admin\AppData\Local\Features\x\interface.jstext
MD5:25E89B669D97D37764A389F1841E82CC
SHA256:EFE8A73AFDC3C17FEA80681035B9BF4EFE5A95B4C396366864BE19CB003E4163
6772WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6013.tmp.xmlxml
MD5:0D41B56E1E926213FDD11885F11FC2E5
SHA256:A2D08B0693590BC4AA5CCDD332BE2325F0203885071A13436FA00CAE99E3AD4B
3872Game_patch-run.exeC:\Users\admin\AppData\Local\Features\x\icon.pngimage
MD5:5F62E1708F9891439ED643945FD4752F
SHA256:8629E952606B85E9A6CEE20A6A13D37DF44ACDEA6B8143B7CAB575B4086777B6
3872Game_patch-run.exeC:\Users\admin\AppData\Local\Temp\temp_cleanup.icotext
MD5:7DA3FBD12E19A6F52F732C078171A2C2
SHA256:1D9BEBFEC33FA5A5381F0D1FCC3A57E83A2F693A2E0D688CDB86ABFA7484A28D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
72
DNS requests
74
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6772
WerFault.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6772
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1336
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3388
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4456
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:srJhk23oPnT_vhIVH7ttX9xTybssaViaVjtOkStFdwU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
3388
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5708
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6772
WerFault.exe
52.182.143.212:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6772
WerFault.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6772
WerFault.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1336
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
watson.events.data.microsoft.com
  • 52.182.143.212
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.4
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.3
  • 40.126.32.72
  • 20.190.160.2
  • 20.190.160.64
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted

Threats

PID
Process
Class
Message
4456
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
4456
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Game.exe