File name:

Orbit.exe

Full analysis: https://app.any.run/tasks/878bd86f-3b61-4229-a064-e21060e0d178
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 02, 2024, 23:02:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

DC18687E24B2A3555AF17A814B68EB82

SHA1:

B02BE766FFCFA93159E56575AFB2B063DEE22ABE

SHA256:

CEFE9CFE75B05A3972BE3E2EF08B1DDFEE4EFA45C57027326E9085B002328252

SSDEEP:

49152:95WIs2+MN/xhU/gylWDOD9Grr2MCQF8uYF9+AnsW:95WIsFhIDQ4gV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Orbit.exe (PID: 4960)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 1604)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 1720)
      • cmd.exe (PID: 3592)
      • cmd.exe (PID: 896)
      • cmd.exe (PID: 5840)
      • cmd.exe (PID: 2512)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 1724)
      • cmd.exe (PID: 472)
      • cmd.exe (PID: 3872)
      • cmd.exe (PID: 3640)
      • cmd.exe (PID: 4524)
      • cmd.exe (PID: 72)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 2128)
      • cmd.exe (PID: 1508)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 5128)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 532)
      • cmd.exe (PID: 1704)

    • Downloads file from URI

      • powershell.exe (PID: 1724)
      • powershell.exe (PID: 2452)
      • powershell.exe (PID: 5712)
      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 1604)
      • powershell.exe (PID: 2916)
      • powershell.exe (PID: 5128)
      • powershell.exe (PID: 1720)
      • powershell.exe (PID: 3196)
      • powershell.exe (PID: 6112)
      • powershell.exe (PID: 1744)
      • powershell.exe (PID: 2084)
      • powershell.exe (PID: 1848)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 3592)
      • powershell.exe (PID: 2740)
      • powershell.exe (PID: 1496)
      • powershell.exe (PID: 4348)
      • powershell.exe (PID: 2932)
      • powershell.exe (PID: 428)

    • Request a resource from the Internet using PowerShell's cmdlet

      • cmd.exe (PID: 3592)
      • cmd.exe (PID: 5840)
      • cmd.exe (PID: 896)
      • cmd.exe (PID: 2512)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 1724)
      • cmd.exe (PID: 472)
      • cmd.exe (PID: 3872)
      • cmd.exe (PID: 72)
      • cmd.exe (PID: 4524)
      • cmd.exe (PID: 3640)
      • cmd.exe (PID: 2128)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 1720)
      • Orbit.exe (PID: 4960)
      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 5128)
      • cmd.exe (PID: 1508)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 532)
      • cmd.exe (PID: 1704)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 1604)

    • Drops a system driver (possible attempt to evade defenses)

      • powershell.exe (PID: 1604)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 3640)

    • Starts CMD.EXE for commands execution

      • Orbit.exe (PID: 4960)

  • INFO

    • Checks supported languages

      • Orbit.exe (PID: 4960)

    • Checks proxy server information

      • powershell.exe (PID: 1724)
      • powershell.exe (PID: 2452)
      • powershell.exe (PID: 5712)
      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 1604)
      • powershell.exe (PID: 2916)
      • powershell.exe (PID: 3196)
      • powershell.exe (PID: 5128)
      • powershell.exe (PID: 1720)
      • powershell.exe (PID: 6112)
      • powershell.exe (PID: 1744)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 2084)
      • powershell.exe (PID: 3500)
      • powershell.exe (PID: 1848)
      • powershell.exe (PID: 3592)
      • powershell.exe (PID: 2740)
      • powershell.exe (PID: 4348)
      • powershell.exe (PID: 1496)
      • powershell.exe (PID: 2932)
      • powershell.exe (PID: 428)

    • Creates files or folders in the user directory

      • Orbit.exe (PID: 4960)

    • Disables trace logs

      • powershell.exe (PID: 1724)
      • powershell.exe (PID: 2452)
      • powershell.exe (PID: 5712)
      • powershell.exe (PID: 1428)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 1604)
      • powershell.exe (PID: 2916)
      • powershell.exe (PID: 3196)
      • powershell.exe (PID: 5128)
      • powershell.exe (PID: 1720)
      • powershell.exe (PID: 6112)
      • powershell.exe (PID: 1744)
      • powershell.exe (PID: 2084)
      • powershell.exe (PID: 3500)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 3592)
      • powershell.exe (PID: 2740)
      • powershell.exe (PID: 1848)
      • powershell.exe (PID: 4348)
      • powershell.exe (PID: 1496)
      • powershell.exe (PID: 2932)
      • powershell.exe (PID: 428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:06:01 13:53:36+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.39
CodeSize: 1005056
InitializedDataSize: 430592
UninitializedDataSize: -
EntryPoint: 0x8f064
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
74
Malicious processes
3
Suspicious processes
35

Behavior graph

Click at the process to see the details
start orbit.exe conhost.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs regedit.exe no specs cmd.exe no specs conhost.exe no specs regedit.exe no specs orbit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
72C:\WINDOWS\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/ZirczWare/CS2-Orbit-Resources/main/Orbit%20Mapdata/ar_shoots.txt' -OutFile 'C:\Users\admin\AppData\Roaming\Orbit\Orbit Mapdata\ar_shoots.txt'"C:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
428powershell -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/ZirczWare/CS2-Orbit-Resources/main/Orbit%20Mapdata/de_vertigo.txt' -OutFile 'C:\Users\admin\AppData\Roaming\Orbit\Orbit Mapdata\de_vertigo.txt'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
472C:\WINDOWS\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/DisableHypervisorEnforcedCodeIntegrity.reg' -OutFile 'C:\Users\admin\AppData\Roaming\Orbit\DisableHypervisorEnforcedCodeIntegrity.reg'"C:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
532C:\WINDOWS\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/ZirczWare/CS2-Orbit-Resources/main/Orbit%20Mapdata/de_overpass.txt' -OutFile 'C:\Users\admin\AppData\Roaming\Orbit\Orbit Mapdata\de_overpass.txt'"C:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
704C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
896C:\WINDOWS\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/SmallestPixel7-Regular.ttf' -OutFile 'C:\Users\admin\AppData\Roaming\Orbit\SmallestPixel7-Regular.ttf'"C:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1104cmd /c cd C:\Users\admin\AppData\Roaming\Orbit && DisableHypervisorEnforcedCodeIntegrity.reg && exitC:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1120C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1364C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—Orbit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1428powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/SmallestPixel7-Regular.ttf' -OutFile 'C:\Users\admin\AppData\Roaming\Orbit\SmallestPixel7-Regular.ttf'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
Total events
122 581
Read events
122 539
Write events
42
Delete events
0

Modification events

(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3500) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
5
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
3500powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ni5zzkjo.yuk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1724powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_eoxomolh.ttx.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1724powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ppfp51bn.avq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2452powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4grcieuy.goa.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5712powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_olohf153.mh5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2452powershell.exeC:\Users\admin\AppData\Roaming\Orbit\Weaponicons-Regular.ttfbinary
MD5:1D84038477421F2CDB62DED83E2046F6
SHA256:298C90B91C908E56E3AE708F094CA76B00A7867318631673CB0CF54961179D43
2452powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_aecdlsez.ukb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3500powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vm5vq2bt.g5w.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1724powershell.exeC:\Users\admin\AppData\Roaming\Orbit\Zappericons-Regular.ttfbinary
MD5:6171764D98CD619BC54DFF71FBDB646B
SHA256:3C5F8071D0897B8C0DD694704B1CC4C051609C98A154E88A088E8E9CCF2FA56A
4944powershell.exeC:\Users\admin\AppData\Roaming\Orbit\DriverMapper.exeexecutable
MD5:8BF69EDDA1E10F0E935038D8299B3EAE
SHA256:E7A503F0A7BC1ACF71034ABC36329B1733F0B67AA6E07BD06688BFD9E333E871
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
53
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5448
svchost.exe
GET
200
2.18.244.223:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2492
RUXIMICS.exe
GET
200
2.18.244.223:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
2.18.244.223:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5448
svchost.exe
GET
200
2.21.17.194:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
2.21.17.194:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
2492
RUXIMICS.exe
GET
200
2.21.17.194:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
GET
302
140.82.121.4:443
https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/Zappericons-Regular.ttf
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/Weaponicons-Regular.ttf
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/SamsungSans-Regular.ttf
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/ZirczWare/CS2-Orbit-Resources/raw/main/SmallestPixel7-Regular.ttf
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5448
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2492
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5448
svchost.exe
2.18.244.223:80
crl.microsoft.com
Akamai International B.V.
FR
unknown
2492
RUXIMICS.exe
2.18.244.223:80
crl.microsoft.com
Akamai International B.V.
FR
unknown
5140
MoUsoCoreWorker.exe
2.18.244.223:80
crl.microsoft.com
Akamai International B.V.
FR
unknown
5448
svchost.exe
2.21.17.194:80
www.microsoft.com
AKAMAI-AS
BE
unknown
5140
MoUsoCoreWorker.exe
2.21.17.194:80
www.microsoft.com
AKAMAI-AS
BE
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.18.244.223
  • 2.18.244.211
whitelisted
www.microsoft.com
  • 2.21.17.194
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
shared
github.com
  • 140.82.121.4
shared
self.events.data.microsoft.com
  • 13.69.239.79
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Orbit.exe