File name:

Orbz.v2.10.crack.by.FFF.exe

Full analysis: https://app.any.run/tasks/3d19b5fc-61e6-4017-8216-1ce17e22e6ca
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: December 23, 2023, 18:45:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
azorult
fareit
pony
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A11B670CF30C42345CD0B41CB58C2A4A

SHA1:

2A09ED2CA9C5958DF7A6AEF3BE8434AFAAF10BDB

SHA256:

FF5BF85298C959EC102B1B32E4900EA5845B83B46B2C6597F919B6D31D58FA81

SSDEEP:

98304:Oyi35kzoIT4LlYEeIMpvtwO+GFOzuPeeQ+Vmx6gTRUF3EyrwSYHKSaUEHXv9+7mj:GGQYPMQJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • key.exe (PID: 1848)
      • taskhost.exe (PID: 1408)
      • setup.exe (PID: 3832)

    • PONY has been detected (SURICATA)

      • key.exe (PID: 1848)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 492)

    • Connects to the CnC server

      • key.exe (PID: 1848)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 3416)
      • regsvr32.exe (PID: 3536)

    • Actions looks like stealing of personal data

      • key.exe (PID: 1848)

    • Create files in the Startup directory

      • regsvr32.exe (PID: 3536)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-step-1.exe (PID: 2080)
      • cmd.exe (PID: 864)
      • keygen-step-3.exe (PID: 492)
      • keygen-pj.exe (PID: 2072)
      • control.exe (PID: 1392)
      • key.exe (PID: 1848)
      • taskmgr.exe (PID: 2028)
      • taskhost.exe (PID: 1408)
      • rundll32.exe (PID: 3268)
      • rundll32.exe (PID: 3272)
      • ie4uinit.exe (PID: 3364)
      • ie4uinit.exe (PID: 3080)
      • ie4uinit.exe (PID: 3504)

    • Starts CMD.EXE for commands execution

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • key.exe (PID: 1848)
      • keygen-step-3.exe (PID: 492)

    • Executing commands from a ".bat" file

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • key.exe (PID: 1848)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 1392)
      • ie4uinit.exe (PID: 3080)
      • rundll32.exe (PID: 3268)

    • Searches for installed software

      • key.exe (PID: 1848)

    • Reads settings of System Certificates

      • keygen-step-3.exe (PID: 492)
      • sipnotify.exe (PID: 2868)

    • Reads security settings of Internet Explorer

      • keygen-step-3.exe (PID: 492)

    • Checks Windows Trust Settings

      • keygen-step-3.exe (PID: 492)

    • Accesses Microsoft Outlook profiles

      • key.exe (PID: 1848)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 3080)

    • Reads Internet Explorer settings

      • ie4uinit.exe (PID: 3080)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 3080)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 3080)
      • regsvr32.exe (PID: 3536)
      • unregmp2.exe (PID: 3416)

    • Changes default file association

      • unregmp2.exe (PID: 3416)

  • INFO

    • Drops the executable file immediately after the start

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)

    • Reads the computer name

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)
      • setup.exe (PID: 3844)
      • setup.exe (PID: 3892)
      • IMEKLMG.EXE (PID: 1404)
      • IMEKLMG.EXE (PID: 3004)

    • Create files in a temporary directory

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)
      • key.exe (PID: 1848)

    • Checks supported languages

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)
      • setup.exe (PID: 3832)
      • setup.exe (PID: 3844)
      • setup.exe (PID: 3892)
      • IMKRMIG.EXE (PID: 296)
      • IMEKLMG.EXE (PID: 1404)
      • IMEKLMG.EXE (PID: 3004)

    • The executable file from the user directory is run by the CMD process

      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-3.exe (PID: 492)

    • Reads Environment values

      • keygen-step-1.exe (PID: 2080)

    • Reads product name

      • keygen-step-1.exe (PID: 2080)

    • Reads the machine GUID from the registry

      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)

    • Checks proxy server information

      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)

    • Manual execution by a user

      • taskmgr.exe (PID: 2028)
      • ie4uinit.exe (PID: 3080)
      • unregmp2.exe (PID: 3416)
      • ie4uinit.exe (PID: 3364)
      • regsvr32.exe (PID: 3536)
      • ie4uinit.exe (PID: 3504)
      • setup.exe (PID: 3832)
      • chrmstp.exe (PID: 3652)
      • IMEKLMG.EXE (PID: 3004)
      • IMEKLMG.EXE (PID: 1404)

    • Executes as Windows Service

      • taskhost.exe (PID: 1408)

    • Application launched itself

      • taskmgr.exe (PID: 2028)
      • ie4uinit.exe (PID: 3080)
      • rundll32.exe (PID: 3268)
      • chrmstp.exe (PID: 3652)
      • chrmstp.exe (PID: 3660)
      • setup.exe (PID: 3832)
      • msedge.exe (PID: 3772)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 2868)

    • Creates files or folders in the user directory

      • keygen-step-3.exe (PID: 492)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 3080)
      • sipnotify.exe (PID: 2868)

    • Creates files in the program directory

      • ie4uinit.exe (PID: 3080)
      • chrmstp.exe (PID: 3660)
      • chrmstp.exe (PID: 3652)
      • setup.exe (PID: 3832)
      • setup.exe (PID: 3892)
      • setup.exe (PID: 3844)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1404)
      • IMEKLMG.EXE (PID: 3004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 14:15:57+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
40
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start orbz.v2.10.crack.by.fff.exe no specs cmd.exe no specs keygen-pj.exe no specs keygen-step-1.exe no specs control.exe no specs keygen-step-3.exe rundll32.exe no specs #PONY key.exe cmd.exe no specs ping.exe no specs cmd.exe no specs taskmgr.exe no specs taskmgr.exe taskhost.exe sipnotify.exe ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs imeklmg.exe no specs imeklmg.exe no specs imkrmig.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\Orbz.v2.10.crack.by.FFF.exe" C:\Users\admin\AppData\Local\Temp\Orbz.v2.10.crack.by.FFF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\orbz.v2.10.crack.by.fff.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
296"C:\Program Files\Common Files\Microsoft Shared\IME14\IMEKR\imkrmig.exe"C:\Program Files\Common Files\Microsoft Shared\IME14\IMEKR\IMKRMIG.EXE—IMEKLMG.EXE
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft IME 2010
Exit code:
0
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\imekr\imkrmig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
492keygen-step-3.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
cmd.exe
User:
admin
Company:
wht
Integrity Level:
MEDIUM
Description:
wht
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
784"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
864C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\System32\cmd.exe—Orbz.v2.10.crack.by.FFF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1392"C:\Windows\System32\control.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl", C:\Windows\System32\control.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1404"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1408"taskhost.exe"C:\Windows\System32\taskhost.exe
services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1644C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1736"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe" >> NULC:\Windows\System32\cmd.exe—keygen-step-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
18 119
Read events
17 105
Write events
1 007
Delete events
7

Modification events

(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2080) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2080) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
14
Suspicious files
76
Text files
66
Unknown types
1

Dropped files

PID
Process
Filename
Type
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cplexecutable
MD5:C74D0FF9FA8AEDFD4FA800F87BA25244
SHA256:017CD316E29CF966B0E3A5E38A19FB1DE3BA5BD91A3549093D5C77AF7CF24FA3
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:4F8CC92BD220656D0D33D83D7E6C1352
SHA256:7BB8BCE3DF116BA96404C0F084D0333D8F0BEFD9FDF59667B98C8955F69DBB32
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exeexecutable
MD5:FD7DBEAC1F7CA63CCE4E5A67B5BAB984
SHA256:B87550150CD0E3ECF8E8A7B62B90CFDDFA4D6414F271B02349E3BB6D3BEB2A14
2072keygen-pj.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exeexecutable
MD5:AA48FA678A65A000FD139EDB33F46565
SHA256:3497EC8D3717BF385A651855082D4A93805296ABC5189A0A81BF51CD80D46D1E
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:A3A78FC361CA97368EE77A406FF39DB1
SHA256:4833C439DC79F191A30C89A601CA428F0EF156ADD0ED2BD33BB0D93C2DA1E516
1848key.exeC:\Users\admin\AppData\Local\Temp\927921.battext
MD5:3880EEB1C736D853EB13B44898B718AB
SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DBE60B13E6665CE8E9A4CAA655027CBF
SHA256:4D912D509D15B3EB62CFA5407BD3D3CFD6A45F7952C180A369F90D4FBA300EDE
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_34D61B4A2A4AE0D3DDAB879224BCA77Bbinary
MD5:89826D14DDA3A852A22A54CEDB40EE59
SHA256:D02AF0B5BFCC035D920588EF588D7898291C6FC54CA11DFFF6C59CC69EF2A9E8
3272rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\4Q0PHJ5B\fwlink[1] —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
12
DNS requests
7
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
185.180.231.18:80
http://gigaload.info/1210776429.php
unknown
text
4 b
unknown
492
keygen-step-3.exe
GET
200
23.32.239.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1242bcaa668520f0
unknown
compressed
4.66 Kb
unknown
492
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
492
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEGxVq9vQB5LHnQcM2BGe1r8%3D
unknown
binary
2.18 Kb
unknown
1848
key.exe
POST
—
188.114.97.3:80
http://top.thisispw.com/keys7369921/gate.php
unknown
—
—
unknown
1080
svchost.exe
GET
304
23.32.239.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?89bca2e7018c82c0
unknown
—
—
unknown
2868
sipnotify.exe
HEAD
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133478307985290000
unknown
—
—
unknown
2868
sipnotify.exe
GET
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133478307985290000
unknown
compressed
78.4 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
—
—
185.180.231.18:80
gigaload.info
Network Management Ltd
RU
unknown
492
keygen-step-3.exe
62.72.28.104:443
www.connectingkeralam.com
PTGi International Carrier Services, Inc.
US
unknown
492
keygen-step-3.exe
23.32.239.82:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
492
keygen-step-3.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
1848
key.exe
188.114.97.3:80
top.thisispw.com
CLOUDFLARENET
NL
unknown
1080
svchost.exe
23.32.239.82:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2868
sipnotify.exe
104.102.39.173:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
gigaload.info
  • 185.180.231.18
unknown
www.connectingkeralam.com
  • 62.72.28.104
unknown
ctldl.windowsupdate.com
  • 23.32.239.82
  • 2.19.198.34
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
top.thisispw.com
  • 188.114.97.3
  • 188.114.96.3
malicious
query.prod.cms.rt.microsoft.com
  • 104.102.39.173
whitelisted

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M2
492
keygen-step-3.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
1848
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
1848
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
1848
key.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Orbz.v2.10.crack.by.FFF.exe