File name:

Game.exe

Full analysis: https://app.any.run/tasks/c97e6060-e3c7-4a77-b17a-5c58e7f73857
Verdict: Malicious activity
Analysis date: June 07, 2025, 08:15:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

5D32B9B7CB912EB480FE7835B68BADEF

SHA1:

227F41E3CA78E079AA0EA4C723495F45918909A2

SHA256:

C7954BC1D5C1B7DBF596C9968239327EFD8D93DC10151FEA54020A16299B8BB5

SSDEEP:

3072:2IYpGMuqWDzyUExux6pVvmUBPJQ9o5ovhxKcKKk2sz/qL:2/pzWDzYxuxYdmUfQB5iDjqL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3332)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3332)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Starts itself from another location

      • Game.exe (PID: 6940)

    • Executable content was dropped or overwritten

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Executes application which crashes

      • Game.exe (PID: 6036)

    • The process creates files with name similar to system file names

      • Game_patch-run.exe (PID: 7048)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Game_patch-run.exe (PID: 7048)

    • Starts CMD.EXE for commands execution

      • Game_patch-run.exe (PID: 7048)
      • cmd.exe (PID: 6368)

    • Executing commands from a ".bat" file

      • Game_patch-run.exe (PID: 7048)

    • Application launched itself

      • cmd.exe (PID: 6368)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6368)
      • cmd.exe (PID: 7372)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6368)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6368)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6368)

    • Manipulates environment variables

      • powershell.exe (PID: 7596)
      • powershell.exe (PID: 6740)
      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 7916)

    • The process executes Powershell scripts

      • cmd.exe (PID: 6368)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6368)

    • Removes files via Powershell

      • powershell.exe (PID: 7596)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 3332)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6368)

    • The process executes JS scripts

      • cmd.exe (PID: 6368)

    • Renames file via Powershell

      • powershell.exe (PID: 7916)

  • INFO

    • Checks supported languages

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)
      • Game.exe (PID: 6036)

    • Reads the computer name

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)
      • Game.exe (PID: 6036)

    • Create files in a temporary directory

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Process checks computer location settings

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Reads the machine GUID from the registry

      • Game.exe (PID: 6036)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7496)
      • Game_patch-run.exe (PID: 7048)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7568)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4696)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7504)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3332)

    • Application launched itself

      • msedge.exe (PID: 2644)
      • msedge.exe (PID: 132)

    • Manual execution by a user

      • msedge.exe (PID: 132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
61
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start game.exe game_patch-run.exe game.exe werfault.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs reg.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs game.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --disable-quic --flag-switches-end --do-not-de-elevate --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2025-06X&u=9loqisshqanoyhqdyvrqhzbdwcvdnenxC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5676 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4648 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1240C:\WINDOWS\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=1308 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2104"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5180 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2516"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6852 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2560"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6740 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2025-06X&u=9loqisshqanoyhqdyvrqhzbdwcvdnenxC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
40 304
Read events
40 258
Write events
43
Delete events
3

Modification events

(PID) Process:(7496) WerFault.exeKey:\REGISTRY\A\{57d5b108-5649-809e-1d16-6fce34d1b265}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(7496) WerFault.exeKey:\REGISTRY\A\{57d5b108-5649-809e-1d16-6fce34d1b265}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:Flags
Value:
14089087
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:AcctUId
Value:
0x000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:RoamingCount
Value:
0
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:SslClientCertReference
Value:
MY;User;0000000000000000000000000000000000000000
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:ProtoVer
Value:
1.2
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:EnrollmentState
Value:
1
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:EnrollmentType
Value:
0
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:IsFederated
Value:
0
Executable files
10
Suspicious files
229
Text files
54
Unknown types
0

Dropped files

PID
Process
Filename
Type
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Game.exe_e6159ebf926c70ee51b3becda91393bfb8c3a_ec47739b_fd0fbd7c-fcbe-40ef-9eda-b734bce11737\Report.wer —
MD5:—
SHA256:—
7496WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Game.exe.6036.dmp —
MD5:—
SHA256:—
6940Game.exeC:\Users\admin\AppData\Local\Temp\nsvF480.tmpbinary
MD5:C108C7A01DE139ADDD19E5EAA83AE0F0
SHA256:A8FF8D3CEF81BCCFCD457FDB1CE5788037D98BF99B776057F547A3E35D4BDF3E
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERFA6C.tmp.xmlxml
MD5:611C831377B90BCDF95A0715A958146B
SHA256:1285E127015883F7B6AB2C983BEF56200379EAFD3946F62A54A6DFE2452DDCBB
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERFA4C.tmp.WERInternalMetadata.xmlxml
MD5:288A5CDD2A9B93E1FF0D784C519915BE
SHA256:9AF3A357C469D3AE40A3534B6C5345001F52E47512F4813033B4C3FF84E9B6CA
7496WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:EF34BE9227FEB82C0F5375A4FF87381E
SHA256:3D0296EFE046569029786D4848D4F4975DA7A4B214BEF247607D934A03ECFE96
7048Game_patch-run.exeC:\Users\admin\AppData\Local\Temp\temp_cleanup.icotext
MD5:7DA3FBD12E19A6F52F732C078171A2C2
SHA256:1D9BEBFEC33FA5A5381F0D1FCC3A57E83A2F693A2E0D688CDB86ABFA7484A28D
7048Game_patch-run.exeC:\Users\admin\Desktop\Game.exeexecutable
MD5:C2F26DCF03CE79D120884CB0EC4B8090
SHA256:8A191BE25D13DDC8EDB54BA5FBD8D19B9F2CC6D7EE6471190C8E641C88189C2B
7048Game_patch-run.exeC:\Users\admin\AppData\Local\Features\x\interface.jstext
MD5:25E89B669D97D37764A389F1841E82CC
SHA256:EFE8A73AFDC3C17FEA80681035B9BF4EFE5A95B4C396366864BE19CB003E4163
7048Game_patch-run.exeC:\Users\admin\AppData\Local\Features\x\web_accessible_resource.jstext
MD5:DCC592CF6D40300BD8E61E650438DCDA
SHA256:2A6AD4FAEBCE67AF0C5751780E10BB5FF676195445E0418A20174B6033A2638D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
57
DNS requests
64
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4448
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5960
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5960
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8020
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4448
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4448
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.0
  • 40.126.31.2
  • 20.190.159.73
  • 40.126.31.131
  • 20.190.159.128
  • 40.126.31.67
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
getadblocktag.com
  • 188.114.96.3
  • 188.114.97.3
unknown
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Game.exe