File name:

Game.exe

Full analysis: https://app.any.run/tasks/c97e6060-e3c7-4a77-b17a-5c58e7f73857
Verdict: Malicious activity
Analysis date: June 07, 2025, 08:15:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

5D32B9B7CB912EB480FE7835B68BADEF

SHA1:

227F41E3CA78E079AA0EA4C723495F45918909A2

SHA256:

C7954BC1D5C1B7DBF596C9968239327EFD8D93DC10151FEA54020A16299B8BB5

SSDEEP:

3072:2IYpGMuqWDzyUExux6pVvmUBPJQ9o5ovhxKcKKk2sz/qL:2/pzWDzYxuxYdmUfQB5iDjqL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3332)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3332)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Starts itself from another location

      • Game.exe (PID: 6940)

    • Reads security settings of Internet Explorer

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Game_patch-run.exe (PID: 7048)

    • Executing commands from a ".bat" file

      • Game_patch-run.exe (PID: 7048)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 7372)
      • cmd.exe (PID: 6368)

    • Starts CMD.EXE for commands execution

      • Game_patch-run.exe (PID: 7048)
      • cmd.exe (PID: 6368)

    • Application launched itself

      • cmd.exe (PID: 6368)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6368)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6368)

    • Executes application which crashes

      • Game.exe (PID: 6036)

    • The process creates files with name similar to system file names

      • Game_patch-run.exe (PID: 7048)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6368)

    • Manipulates environment variables

      • powershell.exe (PID: 7916)
      • powershell.exe (PID: 7596)
      • powershell.exe (PID: 6740)
      • powershell.exe (PID: 3332)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6368)

    • Removes files via Powershell

      • powershell.exe (PID: 7596)

    • Renames file via Powershell

      • powershell.exe (PID: 7916)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6368)

    • The process executes JS scripts

      • cmd.exe (PID: 6368)

    • The process executes Powershell scripts

      • cmd.exe (PID: 6368)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 3332)

  • INFO

    • Reads the computer name

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)
      • Game.exe (PID: 6036)

    • Checks supported languages

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)
      • Game.exe (PID: 6036)

    • Process checks computer location settings

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Create files in a temporary directory

      • Game.exe (PID: 6940)
      • Game_patch-run.exe (PID: 7048)

    • Reads the machine GUID from the registry

      • Game.exe (PID: 6036)

    • Creates files or folders in the user directory

      • Game_patch-run.exe (PID: 7048)
      • WerFault.exe (PID: 7496)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7504)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4696)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7568)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3332)

    • Application launched itself

      • msedge.exe (PID: 2644)
      • msedge.exe (PID: 132)

    • Manual execution by a user

      • msedge.exe (PID: 132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
61
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start game.exe game_patch-run.exe game.exe werfault.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs reg.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs game.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --disable-quic --flag-switches-end --do-not-de-elevate --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2025-06X&u=9loqisshqanoyhqdyvrqhzbdwcvdnenxC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5676 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4648 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1240C:\WINDOWS\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=1308 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2104"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5180 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2516"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6852 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2560"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6740 --field-trial-handle=2412,i,9871556302135236643,615596511562793286,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2025-06X&u=9loqisshqanoyhqdyvrqhzbdwcvdnenxC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
40 304
Read events
40 258
Write events
43
Delete events
3

Modification events

(PID) Process:(7496) WerFault.exeKey:\REGISTRY\A\{57d5b108-5649-809e-1d16-6fce34d1b265}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(7496) WerFault.exeKey:\REGISTRY\A\{57d5b108-5649-809e-1d16-6fce34d1b265}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:Flags
Value:
14089087
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:AcctUId
Value:
0x000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:RoamingCount
Value:
0
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:SslClientCertReference
Value:
MY;User;0000000000000000000000000000000000000000
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:ProtoVer
Value:
1.2
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:EnrollmentState
Value:
1
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:EnrollmentType
Value:
0
(PID) Process:(8144) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
Operation:writeName:IsFederated
Value:
0
Executable files
10
Suspicious files
229
Text files
54
Unknown types
0

Dropped files

PID
Process
Filename
Type
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Game.exe_e6159ebf926c70ee51b3becda91393bfb8c3a_ec47739b_fd0fbd7c-fcbe-40ef-9eda-b734bce11737\Report.wer —
MD5:—
SHA256:—
7496WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Game.exe.6036.dmp —
MD5:—
SHA256:—
6940Game.exeC:\Users\admin\AppData\Local\Temp\nsvF480.tmpbinary
MD5:C108C7A01DE139ADDD19E5EAA83AE0F0
SHA256:A8FF8D3CEF81BCCFCD457FDB1CE5788037D98BF99B776057F547A3E35D4BDF3E
6940Game.exeC:\Users\admin\AppData\Local\Temp\Game_patch-run.exeexecutable
MD5:5D32B9B7CB912EB480FE7835B68BADEF
SHA256:C7954BC1D5C1B7DBF596C9968239327EFD8D93DC10151FEA54020A16299B8BB5
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERFA4C.tmp.WERInternalMetadata.xmlxml
MD5:288A5CDD2A9B93E1FF0D784C519915BE
SHA256:9AF3A357C469D3AE40A3534B6C5345001F52E47512F4813033B4C3FF84E9B6CA
7496WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:EF34BE9227FEB82C0F5375A4FF87381E
SHA256:3D0296EFE046569029786D4848D4F4975DA7A4B214BEF247607D934A03ECFE96
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF970.tmp.dmpbinary
MD5:5CAE2DD06C2000BB17DE540916A14E37
SHA256:B70C5A7F450AE88A824D617439B1372154971A4FB8A7143F1A509CF69665C2D5
7048Game_patch-run.exeC:\Users\admin\AppData\Local\Features\x\icon.pngimage
MD5:5F62E1708F9891439ED643945FD4752F
SHA256:8629E952606B85E9A6CEE20A6A13D37DF44ACDEA6B8143B7CAB575B4086777B6
7048Game_patch-run.exeC:\Users\admin\AppData\Local\Temp\tidy.battext
MD5:35ACA4521F07EB1D53CA116F06A2A357
SHA256:2108D30A164DA8023BAC5BC0B4C9A4BD15988103102472838D9ACA31E2732209
7496WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERFA6C.tmp.xmlxml
MD5:611C831377B90BCDF95A0715A958146B
SHA256:1285E127015883F7B6AB2C983BEF56200379EAFD3946F62A54A6DFE2452DDCBB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
57
DNS requests
64
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4448
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5960
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5960
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8020
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4448
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4448
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.0
  • 40.126.31.2
  • 20.190.159.73
  • 40.126.31.131
  • 20.190.159.128
  • 40.126.31.67
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
getadblocktag.com
  • 188.114.96.3
  • 188.114.97.3
unknown
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Game.exe