File name:

sex.exe

Full analysis: https://app.any.run/tasks/a3c65059-7860-4b7c-bb7e-81c637f72b00
Verdict: Malicious activity
Threats:

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 19:23:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
orcus
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

52ED415E58A6A087C35BE65C9A366544

SHA1:

CF629388316FE07F6E009DE037CEAA03F9E2A13A

SHA256:

CF7CAA9F55F64E73AFA9FB316DACDBBEF4B60941B501D0E38E01FE9EB8BDCC9C

SSDEEP:

49152:iTKd3P51k22nQE7Wj6wogps/+L/hTMfdlArZlI0AilFEvxHi:WWR1z2nQEKO+pBLpG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Orcus is detected

      • sex.exe (PID: 8028)
      • sex.exe (PID: 7788)
      • Orcus.exe (PID: 496)
      • Orcus.exe (PID: 5960)

    • ORCUS has been detected (YARA)

      • Orcus.exe (PID: 5960)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • csc.exe (PID: 7852)
      • csc.exe (PID: 8096)
      • sex.exe (PID: 8028)

    • Reads security settings of Internet Explorer

      • sex.exe (PID: 7788)
      • sex.exe (PID: 8028)

    • Reads the date of Windows installation

      • sex.exe (PID: 7788)
      • sex.exe (PID: 8028)

    • Application launched itself

      • sex.exe (PID: 7788)

    • Write to the desktop.ini file (may be used to cloak folders)

      • sex.exe (PID: 8028)

    • Starts itself from another location

      • sex.exe (PID: 8028)

    • The process executes via Task Scheduler

      • Orcus.exe (PID: 496)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • There is functionality for taking screenshot (YARA)

      • Orcus.exe (PID: 5960)

  • INFO

    • Checks supported languages

      • csc.exe (PID: 7852)
      • sex.exe (PID: 7788)
      • cvtres.exe (PID: 7928)
      • csc.exe (PID: 8096)
      • cvtres.exe (PID: 8156)
      • sex.exe (PID: 8028)
      • Orcus.exe (PID: 5960)
      • Orcus.exe (PID: 496)

    • Create files in a temporary directory

      • sex.exe (PID: 7788)
      • csc.exe (PID: 7852)
      • cvtres.exe (PID: 7928)
      • cvtres.exe (PID: 8156)
      • csc.exe (PID: 8096)
      • sex.exe (PID: 8028)

    • Reads the machine GUID from the registry

      • sex.exe (PID: 7788)
      • csc.exe (PID: 7852)
      • cvtres.exe (PID: 7928)
      • cvtres.exe (PID: 8156)
      • sex.exe (PID: 8028)
      • csc.exe (PID: 8096)
      • Orcus.exe (PID: 5960)
      • Orcus.exe (PID: 496)

    • Reads the computer name

      • sex.exe (PID: 7788)
      • sex.exe (PID: 8028)
      • Orcus.exe (PID: 5960)
      • Orcus.exe (PID: 496)

    • Creates files in the program directory

      • sex.exe (PID: 8028)

    • Process checks computer location settings

      • sex.exe (PID: 7788)
      • sex.exe (PID: 8028)

    • Checks proxy server information

      • slui.exe (PID: 7292)

    • Reads the software policy settings

      • slui.exe (PID: 7292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Orcus

(PID) Process(5960) Orcus.exe
C2 (1)s7vety-27063.portmap.host:27063
Keys
AES7df3b5e703bb1b4943d5534d74a624cb09d12bb3a109a48151088b85f4d2daed
Salt
Options
AutostartBuilderProperty
AutostartMethodDisable
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2024-04-10T22:15:38
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledtrue
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFilefalse
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutexc2650280f7124fd997ae2eae59f1f306
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledtrue
TaskNamerundll32
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins
PluginNameBSoD Protection
PluginVersion2.0
ResourceName3465ab4c615b4010910c68ffcd7fd543
ResourceTypeClientPlugin
Guiddccbc1db-f7d1-413d-bba4-72611d485d3a
PluginNameDisable Webcam Lights
PluginVersion1.0
ResourceNamee3dd0bd294e94869ad67585b574e2dce
ResourceTypeClientPlugin
Guide6ee5674-bb94-46c7-8bbc-5729af6e2c28
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:10 16:19:32+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 926720
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0xe424e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: Orcus.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Orcus.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
12
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ORCUS sex.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs #ORCUS sex.exe csc.exe conhost.exe no specs cvtres.exe no specs #ORCUS orcus.exe no specs #ORCUS orcus.exe no specs svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Orcus\Orcus.exe"C:\Program Files\Orcus\Orcus.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\orcus\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5960"C:\Program Files\Orcus\Orcus.exe" C:\Program Files\Orcus\Orcus.exe
sex.exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.0.0
Modules
Images
c:\program files\orcus\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Orcus
(PID) Process(5960) Orcus.exe
C2 (1)s7vety-27063.portmap.host:27063
Keys
AES7df3b5e703bb1b4943d5534d74a624cb09d12bb3a109a48151088b85f4d2daed
Salt
Options
AutostartBuilderProperty
AutostartMethodDisable
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2024-04-10T22:15:38
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledtrue
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFilefalse
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutexc2650280f7124fd997ae2eae59f1f306
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledtrue
TaskNamerundll32
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins
PluginNameBSoD Protection
PluginVersion2.0
ResourceName3465ab4c615b4010910c68ffcd7fd543
ResourceTypeClientPlugin
Guiddccbc1db-f7d1-413d-bba4-72611d485d3a
PluginNameDisable Webcam Lights
PluginVersion1.0
ResourceNamee3dd0bd294e94869ad67585b574e2dce
ResourceTypeClientPlugin
Guide6ee5674-bb94-46c7-8bbc-5729af6e2c28
7292C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7788"C:\Users\admin\Desktop\sex.exe" C:\Users\admin\Desktop\sex.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\sex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7852"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\_n0jf8r5.cmdline"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
sex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\msvcr80.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\rpcrt4.dll
7860\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7928C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESCAC5.tmp" "c:\Users\admin\AppData\Local\Temp\CSCCAC4.tmp"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.9672 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework64\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\msvcr80.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
8028"C:\Users\admin\Desktop\sex.exe" /waitC:\Users\admin\Desktop\sex.exe
sex.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\sex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
8096"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\u0pzrqp8.cmdline"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
sex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework64\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\msvcr80.dll
Total events
4 835
Read events
4 835
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
5
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7852csc.exeC:\Users\admin\AppData\Local\Temp\CSCCAC4.tmpbinary
MD5:981A956C67B722E84B7FBD56DCE63B02
SHA256:3A19295F073EA8A035250FB6F0A42FD802FAAB898F8CF3518493E6BC4245E30C
8096csc.exeC:\Users\admin\AppData\Local\Temp\u0pzrqp8.dllexecutable
MD5:D4930B1E0D9B35FDAF17E520DBFA78B7
SHA256:570178E1FEC605B290E698C1A631FBF206EF56BAD572E9AE46AF378FA4AE126A
7852csc.exeC:\Users\admin\AppData\Local\Temp\_n0jf8r5.dllexecutable
MD5:99AAB852BC836B2D723F7F2F7D1767FE
SHA256:EB2FFD9B14BA4CAA5089836484BCFDC574367AE4DDBFE00C1845121F05EDC3F7
7928cvtres.exeC:\Users\admin\AppData\Local\Temp\RESCAC5.tmpbinary
MD5:2034A7BA9F31AC1F5DE3C789CF9BF9CE
SHA256:3B6EEE81EAB8EE86690545E08C9E31BAB27C42C61FC9B4291473F93CCA88263E
8028sex.exeC:\Windows\assembly\Desktop.inibinary
MD5:F7F759A5CD40BC52172E83486B6DE404
SHA256:A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
7788sex.exeC:\Users\admin\AppData\Local\Temp\_n0jf8r5.cmdlinetext
MD5:8EF403C6C703E6D5843B08442AE93693
SHA256:DF79C22531108CDF457428148D8953219E2DC77AB1BF3ECB8CB8C080D1CC353A
7852csc.exeC:\Users\admin\AppData\Local\Temp\_n0jf8r5.outtext
MD5:1D3E442EEE42D882512AB59262CEF6A3
SHA256:0F5BDA617943AB5DA403D8B309EB2458A558C374747A816BD7C6C6736FB761DD
8028sex.exeC:\Users\admin\AppData\Local\Temp\u0pzrqp8.0.cstext
MD5:6D70A8550F403ED3C0E5BB74B6ED525B
SHA256:2A8F2E846E5D0B1828729C89EFE35EBE9786493ECBAAA360432FB4C1B42EE029
8028sex.exeC:\Users\admin\AppData\Local\Temp\u0pzrqp8.cmdlinetext
MD5:A2AF74F15B9B88AA5267EC205145F405
SHA256:769FD59CECB9BF96C068CAE0CFC795BAD4F61CDB8B896BA523FA30A75D2006EF
8156cvtres.exeC:\Users\admin\AppData\Local\Temp\RESD41C.tmpbinary
MD5:126E8EB28FC0D72D78B2247D69DD65E4
SHA256:91B68157C18C0250E3F88EC2658F414B8FC74806A89B8FFEA74AEA6DF63CB0EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
49
DNS requests
31
Threats
30

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4996
RUXIMICS.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.2:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
40.126.32.138:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
4996
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
400
20.190.160.65:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.160.65:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.129:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.129:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4996
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4996
RUXIMICS.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4996
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
  • 23.48.23.194
  • 23.48.23.195
  • 23.48.23.179
  • 23.48.23.193
  • 23.48.23.135
  • 23.48.23.134
  • 23.48.23.185
  • 23.48.23.183
  • 23.48.23.180
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.128
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.4
  • 20.190.160.17
whitelisted
s7vety-27063.portmap.host
  • —
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sex.exe