File name:

Orbz.v2.10.crack.by.FFF.exe

Full analysis: https://app.any.run/tasks/3d19b5fc-61e6-4017-8216-1ce17e22e6ca
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: December 23, 2023, 18:45:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
azorult
fareit
pony
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A11B670CF30C42345CD0B41CB58C2A4A

SHA1:

2A09ED2CA9C5958DF7A6AEF3BE8434AFAAF10BDB

SHA256:

FF5BF85298C959EC102B1B32E4900EA5845B83B46B2C6597F919B6D31D58FA81

SSDEEP:

98304:Oyi35kzoIT4LlYEeIMpvtwO+GFOzuPeeQ+Vmx6gTRUF3EyrwSYHKSaUEHXv9+7mj:GGQYPMQJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • key.exe (PID: 1848)
      • taskhost.exe (PID: 1408)
      • setup.exe (PID: 3832)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 492)

    • Connects to the CnC server

      • key.exe (PID: 1848)

    • PONY has been detected (SURICATA)

      • key.exe (PID: 1848)

    • Actions looks like stealing of personal data

      • key.exe (PID: 1848)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 3416)
      • regsvr32.exe (PID: 3536)

    • Create files in the Startup directory

      • regsvr32.exe (PID: 3536)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-step-1.exe (PID: 2080)
      • cmd.exe (PID: 864)
      • keygen-step-3.exe (PID: 492)
      • keygen-pj.exe (PID: 2072)
      • control.exe (PID: 1392)
      • key.exe (PID: 1848)
      • taskmgr.exe (PID: 2028)
      • ie4uinit.exe (PID: 3080)
      • taskhost.exe (PID: 1408)
      • rundll32.exe (PID: 3268)
      • rundll32.exe (PID: 3272)
      • ie4uinit.exe (PID: 3364)
      • ie4uinit.exe (PID: 3504)

    • Executing commands from a ".bat" file

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • key.exe (PID: 1848)

    • Starts CMD.EXE for commands execution

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 1392)
      • ie4uinit.exe (PID: 3080)
      • rundll32.exe (PID: 3268)

    • Reads security settings of Internet Explorer

      • keygen-step-3.exe (PID: 492)

    • Searches for installed software

      • key.exe (PID: 1848)

    • Reads settings of System Certificates

      • keygen-step-3.exe (PID: 492)
      • sipnotify.exe (PID: 2868)

    • Checks Windows Trust Settings

      • keygen-step-3.exe (PID: 492)

    • Accesses Microsoft Outlook profiles

      • key.exe (PID: 1848)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 3080)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 3080)
      • unregmp2.exe (PID: 3416)
      • regsvr32.exe (PID: 3536)

    • Reads Internet Explorer settings

      • ie4uinit.exe (PID: 3080)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 3080)

    • Changes default file association

      • unregmp2.exe (PID: 3416)

  • INFO

    • Drops the executable file immediately after the start

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)

    • Checks supported languages

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)
      • setup.exe (PID: 3832)
      • setup.exe (PID: 3844)
      • setup.exe (PID: 3892)
      • IMEKLMG.EXE (PID: 3004)
      • IMEKLMG.EXE (PID: 1404)
      • IMKRMIG.EXE (PID: 296)

    • Reads the computer name

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-3.exe (PID: 492)
      • key.exe (PID: 1848)
      • setup.exe (PID: 3844)
      • setup.exe (PID: 3892)
      • IMEKLMG.EXE (PID: 3004)
      • IMEKLMG.EXE (PID: 1404)

    • Create files in a temporary directory

      • Orbz.v2.10.crack.by.FFF.exe (PID: 116)
      • keygen-pj.exe (PID: 2072)
      • key.exe (PID: 1848)

    • The executable file from the user directory is run by the CMD process

      • keygen-step-1.exe (PID: 2080)
      • keygen-pj.exe (PID: 2072)
      • keygen-step-3.exe (PID: 492)

    • Reads Environment values

      • keygen-step-1.exe (PID: 2080)

    • Reads product name

      • keygen-step-1.exe (PID: 2080)

    • Reads the machine GUID from the registry

      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)

    • Checks proxy server information

      • keygen-step-1.exe (PID: 2080)
      • keygen-step-3.exe (PID: 492)

    • Creates files or folders in the user directory

      • keygen-step-3.exe (PID: 492)

    • Manual execution by a user

      • taskmgr.exe (PID: 2028)
      • ie4uinit.exe (PID: 3080)
      • ie4uinit.exe (PID: 3364)
      • unregmp2.exe (PID: 3416)
      • ie4uinit.exe (PID: 3504)
      • regsvr32.exe (PID: 3536)
      • chrmstp.exe (PID: 3652)
      • setup.exe (PID: 3832)
      • IMEKLMG.EXE (PID: 3004)
      • IMEKLMG.EXE (PID: 1404)

    • Application launched itself

      • taskmgr.exe (PID: 2028)
      • ie4uinit.exe (PID: 3080)
      • rundll32.exe (PID: 3268)
      • chrmstp.exe (PID: 3652)
      • chrmstp.exe (PID: 3660)
      • setup.exe (PID: 3832)
      • msedge.exe (PID: 3772)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 2868)

    • Executes as Windows Service

      • taskhost.exe (PID: 1408)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 3080)
      • sipnotify.exe (PID: 2868)

    • Creates files in the program directory

      • ie4uinit.exe (PID: 3080)
      • chrmstp.exe (PID: 3652)
      • setup.exe (PID: 3844)
      • setup.exe (PID: 3832)
      • chrmstp.exe (PID: 3660)
      • setup.exe (PID: 3892)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1404)
      • IMEKLMG.EXE (PID: 3004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 14:15:57+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
40
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start orbz.v2.10.crack.by.fff.exe no specs cmd.exe no specs keygen-pj.exe no specs keygen-step-1.exe no specs control.exe no specs keygen-step-3.exe rundll32.exe no specs #PONY key.exe cmd.exe no specs ping.exe no specs cmd.exe no specs taskmgr.exe no specs taskmgr.exe taskhost.exe sipnotify.exe ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs imeklmg.exe no specs imeklmg.exe no specs imkrmig.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\Orbz.v2.10.crack.by.FFF.exe" C:\Users\admin\AppData\Local\Temp\Orbz.v2.10.crack.by.FFF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\orbz.v2.10.crack.by.fff.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
296"C:\Program Files\Common Files\Microsoft Shared\IME14\IMEKR\imkrmig.exe"C:\Program Files\Common Files\Microsoft Shared\IME14\IMEKR\IMKRMIG.EXE—IMEKLMG.EXE
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft IME 2010
Exit code:
0
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\imekr\imkrmig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
492keygen-step-3.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
cmd.exe
User:
admin
Company:
wht
Integrity Level:
MEDIUM
Description:
wht
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
784"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
864C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\System32\cmd.exe—Orbz.v2.10.crack.by.FFF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1392"C:\Windows\System32\control.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl", C:\Windows\System32\control.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1404"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1408"taskhost.exe"C:\Windows\System32\taskhost.exe
services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1644C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1736"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe" >> NULC:\Windows\System32\cmd.exe—keygen-step-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
18 119
Read events
17 105
Write events
1 007
Delete events
7

Modification events

(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) Orbz.v2.10.crack.by.FFF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2080) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2080) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(864) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
14
Suspicious files
76
Text files
66
Unknown types
1

Dropped files

PID
Process
Filename
Type
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:6F5D413200C535136F01734ABD968982
SHA256:D4E45D7D68BC5275FE72298A51DFA7C9FAB2628FD0511CF9053C3BA1A0B7DB09
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:A3A78FC361CA97368EE77A406FF39DB1
SHA256:4833C439DC79F191A30C89A601CA428F0EF156ADD0ED2BD33BB0D93C2DA1E516
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_34D61B4A2A4AE0D3DDAB879224BCA77Bbinary
MD5:89826D14DDA3A852A22A54CEDB40EE59
SHA256:D02AF0B5BFCC035D920588EF588D7898291C6FC54CA11DFFF6C59CC69EF2A9E8
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeexecutable
MD5:7C7EB58A27069EA17214FD3C7733F6AC
SHA256:B0D8F2ACD2450C5436366796883AE58F2B26184C04E547D808CF28F59F664B7D
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2072keygen-pj.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exeexecutable
MD5:AA48FA678A65A000FD139EDB33F46565
SHA256:3497EC8D3717BF385A651855082D4A93805296ABC5189A0A81BF51CD80D46D1E
3080ie4uinit.exeC:\Users\ADMINI~1\AppData\Local\Temp\RGI21B8.tmptext
MD5:31CB7778F65DF8D02353E6C7B2B2CFFC
SHA256:647A8C7F316EF325F73C2037E8883854F9287584904C977C81D1662DB6471A58
492keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:3FBF7B8F3C105CED6F7C0914BAB9BB5A
SHA256:C14B68F2FEEADF1D4279DABC17E15BE762B47A57FD8053984425470E6EF8B084
116Orbz.v2.10.crack.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cplexecutable
MD5:C74D0FF9FA8AEDFD4FA800F87BA25244
SHA256:017CD316E29CF966B0E3A5E38A19FB1DE3BA5BD91A3549093D5C77AF7CF24FA3
3272rundll32.exeC:\Users\Administrator\AppData\Local\Microsoft\Feeds Cache\4Q0PHJ5B\fwlink[1] —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
12
DNS requests
7
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
185.180.231.18:80
http://gigaload.info/1210776429.php
unknown
text
4 b
—
492
keygen-step-3.exe
GET
200
23.32.239.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1242bcaa668520f0
unknown
compressed
4.66 Kb
—
492
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
—
492
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEGxVq9vQB5LHnQcM2BGe1r8%3D
unknown
binary
2.18 Kb
—
1848
key.exe
POST
—
188.114.97.3:80
http://top.thisispw.com/keys7369921/gate.php
unknown
—
—
—
1080
svchost.exe
GET
304
23.32.239.82:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?89bca2e7018c82c0
unknown
—
—
—
2868
sipnotify.exe
HEAD
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133478307985290000
unknown
—
—
—
2868
sipnotify.exe
GET
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133478307985290000
unknown
compressed
78.4 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
—
—
185.180.231.18:80
gigaload.info
Network Management Ltd
RU
unknown
492
keygen-step-3.exe
62.72.28.104:443
www.connectingkeralam.com
PTGi International Carrier Services, Inc.
US
unknown
492
keygen-step-3.exe
23.32.239.82:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
492
keygen-step-3.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
1848
key.exe
188.114.97.3:80
top.thisispw.com
CLOUDFLARENET
NL
unknown
1080
svchost.exe
23.32.239.82:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2868
sipnotify.exe
104.102.39.173:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
gigaload.info
  • 185.180.231.18
unknown
www.connectingkeralam.com
  • 62.72.28.104
unknown
ctldl.windowsupdate.com
  • 23.32.239.82
  • 2.19.198.34
unknown
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
unknown
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
unknown
top.thisispw.com
  • 188.114.97.3
  • 188.114.96.3
unknown
query.prod.cms.rt.microsoft.com
  • 104.102.39.173
unknown

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M2
—
—
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
—
—
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
—
—
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
—
—
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Orbz.v2.10.crack.by.FFF.exe