File name:

Orbz.v2.10.crack.by.FFF.exe

Full analysis: https://app.any.run/tasks/3d19b5fc-61e6-4017-8216-1ce17e22e6ca
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: December 23, 2023, 18:45:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
azorult
fareit
pony
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A11B670CF30C42345CD0B41CB58C2A4A

SHA1:

2A09ED2CA9C5958DF7A6AEF3BE8434AFAAF10BDB

SHA256:

FF5BF85298C959EC102B1B32E4900EA5845B83B46B2C6597F919B6D31D58FA81

SSDEEP:

98304:Oyi35kzoIT4LlYEeIMpvtwO+GFOzuPeeQ+Vmx6gTRUF3EyrwSYHKSaUEHXv9+7mj:GGQYPMQJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 492)

    • Connects to the CnC server

      • key.exe (PID: 1848)

    • Steals credentials from Web Browsers

      • key.exe (PID: 1848)
      • taskhost.exe (PID: 1408)
      • setup.exe (PID: 3832)

    • Actions looks like stealing of personal data

      • key.exe (PID: 1848)

    • PONY has been detected (SURICATA)

      • key.exe (PID: 1848)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 3416)
      • regsvr32.exe (PID: 3536)

    • Create files in the Startup directory

      • regsvr32.exe (PID: 3536)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 864)
      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • control.exe (PID: 1392)
      • keygen-step-3.exe (PID: 492)
      • keygen-pj.exe (PID: 2072)
      • key.exe (PID: 1848)
      • ie4uinit.exe (PID: 3080)
      • taskmgr.exe (PID: 2028)
      • rundll32.exe (PID: 3268)
      • taskhost.exe (PID: 1408)
      • rundll32.exe (PID: 3272)
      • ie4uinit.exe (PID: 3364)
      • ie4uinit.exe (PID: 3504)
      • keygen-step-1.exe (PID: 2080)

    • Searches for installed software

      • key.exe (PID: 1848)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 1392)
      • ie4uinit.exe (PID: 3080)
      • rundll32.exe (PID: 3268)

    • Checks Windows Trust Settings

      • keygen-step-3.exe (PID: 492)

    • Reads settings of System Certificates

      • keygen-step-3.exe (PID: 492)
      • sipnotify.exe (PID: 2868)

    • Reads security settings of Internet Explorer

      • keygen-step-3.exe (PID: 492)

    • Accesses Microsoft Outlook profiles

      • key.exe (PID: 1848)

    • Starts CMD.EXE for commands execution

      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)
      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)

    • Executing commands from a ".bat" file

      • key.exe (PID: 1848)
      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 3080)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 3080)
      • unregmp2.exe (PID: 3416)
      • regsvr32.exe (PID: 3536)

    • Reads Internet Explorer settings

      • ie4uinit.exe (PID: 3080)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 3080)

    • Changes default file association

      • unregmp2.exe (PID: 3416)

  • INFO

    • Checks supported languages

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)
      • key.exe (PID: 1848)
      • keygen-step-3.exe (PID: 492)
      • setup.exe (PID: 3832)
      • setup.exe (PID: 3892)
      • setup.exe (PID: 3844)
      • IMEKLMG.EXE (PID: 3004)
      • IMKRMIG.EXE (PID: 296)
      • IMEKLMG.EXE (PID: 1404)

    • Drops the executable file immediately after the start

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)

    • Reads the machine GUID from the registry

      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)

    • Reads product name

      • keygen-step-1.exe (PID: 2080)

    • Checks proxy server information

      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)

    • Reads Environment values

      • keygen-step-1.exe (PID: 2080)

    • The executable file from the user directory is run by the CMD process

      • keygen-step-3.exe (PID: 492)
      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)

    • Reads the computer name

      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)
      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • setup.exe (PID: 3892)
      • setup.exe (PID: 3844)
      • IMEKLMG.EXE (PID: 3004)
      • IMEKLMG.EXE (PID: 1404)

    • Create files in a temporary directory

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)
      • key.exe (PID: 1848)

    • Creates files or folders in the user directory

      • keygen-step-3.exe (PID: 492)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 2868)

    • Application launched itself

      • taskmgr.exe (PID: 2028)
      • ie4uinit.exe (PID: 3080)
      • rundll32.exe (PID: 3268)
      • chrmstp.exe (PID: 3652)
      • chrmstp.exe (PID: 3660)
      • setup.exe (PID: 3832)
      • msedge.exe (PID: 3772)

    • Executes as Windows Service

      • taskhost.exe (PID: 1408)

    • Manual execution by a user

      • ie4uinit.exe (PID: 3080)
      • taskmgr.exe (PID: 2028)
      • regsvr32.exe (PID: 3536)
      • ie4uinit.exe (PID: 3504)
      • ie4uinit.exe (PID: 3364)
      • unregmp2.exe (PID: 3416)
      • setup.exe (PID: 3832)
      • chrmstp.exe (PID: 3652)
      • IMEKLMG.EXE (PID: 3004)
      • IMEKLMG.EXE (PID: 1404)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 3080)
      • sipnotify.exe (PID: 2868)

    • Creates files in the program directory

      • ie4uinit.exe (PID: 3080)
      • chrmstp.exe (PID: 3652)
      • chrmstp.exe (PID: 3660)
      • setup.exe (PID: 3892)
      • setup.exe (PID: 3844)
      • setup.exe (PID: 3832)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1404)
      • IMEKLMG.EXE (PID: 3004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 14:15:57+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
40
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start orbz.v2.10.crack.by.fff.exe no specs cmd.exe no specs keygen-pj.exe no specs keygen-step-1.exe no specs control.exe no specs keygen-step-3.exe rundll32.exe no specs #PONY key.exe cmd.exe no specs ping.exe no specs cmd.exe no specs taskmgr.exe no specs taskmgr.exe taskhost.exe sipnotify.exe ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs imeklmg.exe no specs imeklmg.exe no specs imkrmig.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\Orbz.v2.10.crack.by.FFF.exe" C:\Users\admin\AppData\Local\Temp\Orbz.v2.10.crack.by.FFF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\orbz.v2.10.crack.by.fff.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
296"C:\Program Files\Common Files\Microsoft Shared\IME14\IMEKR\imkrmig.exe"C:\Program Files\Common Files\Microsoft Shared\IME14\IMEKR\IMKRMIG.EXE—IMEKLMG.EXE
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft IME 2010
Exit code:
0
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\imekr\imkrmig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
492keygen-step-3.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
cmd.exe
User:
admin
Company:
wht
Integrity Level:
MEDIUM
Description:
wht
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
784"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
864C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\System32\cmd.exe—Orbz.v2.10.crack.by.FFF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1392"C:\Windows\System32\control.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl", C:\Windows\System32\control.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1404"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1408"taskhost.exe"C:\Windows\System32\taskhost.exe
services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1644C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1736"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe" >> NULC:\Windows\System32\cmd.exe—keygen-step-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
18 119
Read events
17 105
Write events
1 007
Delete events
7

Modification events

(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2080) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2080) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
14
Suspicious files
76
Text files
66
Unknown types
1

Dropped files

PID
Process
Filename
Type
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:A3A78FC361CA97368EE77A406FF39DB1
SHA256:4833C439DC79F191A30C89A601CA428F0EF156ADD0ED2BD33BB0D93C2DA1E516
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exeexecutable
MD5:FD7DBEAC1F7CA63CCE4E5A67B5BAB984
SHA256:B87550150CD0E3ECF8E8A7B62B90CFDDFA4D6414F271B02349E3BB6D3BEB2A14
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:4F8CC92BD220656D0D33D83D7E6C1352
SHA256:7BB8BCE3DF116BA96404C0F084D0333D8F0BEFD9FDF59667B98C8955F69DBB32
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cplexecutable
MD5:C74D0FF9FA8AEDFD4FA800F87BA25244
SHA256:017CD316E29CF966B0E3A5E38A19FB1DE3BA5BD91A3549093D5C77AF7CF24FA3
3080ie4uinit.exeC:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xmlxml
MD5:CAEEF699DDB055C4BCF9EED5AA412F20
SHA256:395D4587E1A057E7369B95563BE2DD37BC55988318180668779BDF2E6590FE42
1848key.exeC:\Users\admin\AppData\Local\Temp\927921.battext
MD5:3880EEB1C736D853EB13B44898B718AB
SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7
3080ie4uinit.exeC:\Users\ADMINI~1\AppData\Local\Temp\RGI21B7.tmptext
MD5:31CB7778F65DF8D02353E6C7B2B2CFFC
SHA256:647A8C7F316EF325F73C2037E8883854F9287584904C977C81D1662DB6471A58
3080ie4uinit.exeC:\Users\ADMINI~1\AppData\Local\Temp\RGI21EA.tmptext
MD5:31CB7778F65DF8D02353E6C7B2B2CFFC
SHA256:647A8C7F316EF325F73C2037E8883854F9287584904C977C81D1662DB6471A58
3272rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\4Q0PHJ5B\fwlink[1] —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
12
DNS requests
7
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
185.180.231.18:80
http://gigaload.info/1210776429.php
unknown
text
4 b
unknown
492
keygen-step-3.exe
GET
200
23.32.239.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1242bcaa668520f0
unknown
compressed
4.66 Kb
unknown
492
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
492
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEGxVq9vQB5LHnQcM2BGe1r8%3D
unknown
binary
2.18 Kb
unknown
1848
key.exe
POST
—
188.114.97.3:80
http://top.thisispw.com/keys7369921/gate.php
unknown
—
—
unknown
1080
svchost.exe
GET
304
23.32.239.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?89bca2e7018c82c0
unknown
—
—
unknown
2868
sipnotify.exe
GET
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133478307985290000
unknown
compressed
78.4 Kb
unknown
2868
sipnotify.exe
HEAD
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133478307985290000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
—
—
185.180.231.18:80
gigaload.info
Network Management Ltd
RU
unknown
492
keygen-step-3.exe
62.72.28.104:443
www.connectingkeralam.com
PTGi International Carrier Services, Inc.
US
unknown
492
keygen-step-3.exe
23.32.239.82:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
492
keygen-step-3.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
1848
key.exe
188.114.97.3:80
top.thisispw.com
CLOUDFLARENET
NL
unknown
1080
svchost.exe
23.32.239.82:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2868
sipnotify.exe
104.102.39.173:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
gigaload.info
  • 185.180.231.18
unknown
www.connectingkeralam.com
  • 62.72.28.104
unknown
ctldl.windowsupdate.com
  • 23.32.239.82
  • 2.19.198.34
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
top.thisispw.com
  • 188.114.97.3
  • 188.114.96.3
malicious
query.prod.cms.rt.microsoft.com
  • 104.102.39.173
whitelisted

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M2
492
keygen-step-3.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
1848
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
1848
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
1848
key.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Orbz.v2.10.crack.by.FFF.exe