File name:

Ableton-Keygens-DANGEROUS.7z

Full analysis: https://app.any.run/tasks/7f0352e3-2fc5-4477-ba07-d3448ee5a541
Verdict: Malicious activity
Analysis date: July 04, 2025, 00:18:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

EDC8F910B9E754C547530208BC29CE43

SHA1:

64785FBCA919D062216E8160C1A46BF37E735668

SHA256:

1242DF3909757091B19001311ED965550430DD81D0B77335675D579AF065213E

SSDEEP:

98304:zMtGLQCK7zxNsopAKCGWb2n9NBshOdHbMZmdKJWWqD7zkNUotjPCGWl2QONLilIv:zOY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 4692)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 4692)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4692)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 4692)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4692)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 6688)

    • Checks supported languages

      • MpCmdRun.exe (PID: 6688)

    • Reads the computer name

      • MpCmdRun.exe (PID: 6688)

    • Checks proxy server information

      • slui.exe (PID: 4748)

    • Reads the software policy settings

      • slui.exe (PID: 4748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2025:07:03 22:17:06+00:00
ArchivedFileName: Ableton - Live 12 Suite v12.1.0 {R2R}
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1300C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Rar$Scan36115.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4692"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Ableton-Keygens-DANGEROUS.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4748C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6688"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
Total events
5 012
Read events
5 003
Write events
9
Delete events
0

Modification events

(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Ableton-Keygens-DANGEROUS.7z
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4692) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
4
Suspicious files
1
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton.Live.12.Suite.v12.1.10.Incl.Keygen-R2R\R2R\R2R.txttext
MD5:2E4DB7AA5355A5684CF88CFB698C247B
SHA256:AA84A65A36C4A313E72D65A7625DC13EA23897E7B716FBD407F03C3939DBC241
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton - Live 12 Suite v12.1.0 {R2R}\R2R\Ableton_KeyGen.exeexecutable
MD5:E411DD01187DF2E61A273E651107B524
SHA256:D613BBF19A5003A2C514056665F79C7C2C3AFF9D3712639F13078734FFFCAE5B
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton.Live.12.Suite.v12.1.10.Incl.Keygen-R2R\R2R.nfotext
MD5:E8C8200B310C5290BE948C1A6390184D
SHA256:F7357197FB2011968CC5C93A89888936E652CFA5CC62CC0D29283E328CF8A7B7
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton - Live 12 Suite v12.1.0 {R2R}\R2R\R2R.txttext
MD5:2E4DB7AA5355A5684CF88CFB698C247B
SHA256:AA84A65A36C4A313E72D65A7625DC13EA23897E7B716FBD407F03C3939DBC241
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton - Live 12 Suite v12.1.0 {R2R}\R2R\Keygen+VCRuntime Backup.7zcompressed
MD5:A84BA956733883BD35F863893A60C48D
SHA256:1074AA2F7827C1981A231F82732AFF9EF57A008B93C261799B58C38D5D55AFD6
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton - Live 12 Suite v12.1.0 {R2R}\Rutracker.nfotext
MD5:96D222EC4DF8178BFB5E1CE269221976
SHA256:BBFE3A060FBD016CA47EE5A64EEEBF20F780C419738EF8574BAD6039B9B793CF
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton - Live 12 Suite v12.1.0 {R2R}\R2R\R2R.nfotext
MD5:D06446E549804262BC9139FE4EAC079F
SHA256:2BD7496164C542F4216E31934B01DFB990D911AB95AB1809F1583E31B372721D
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton - Live 12 Suite v12.1.0 {R2R}\R2R\vcruntime140_1.dllexecutable
MD5:F38BBB2DCEA08BE0AE9E8C4447E9CD58
SHA256:A9D61D9FCEE0D83656757EB36A8586DE44D1E4F47BEBD13AFDBD474A47B82209
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Ableton-Keygens-DANGEROUS.7z\Ableton.Live.12.Suite.v12.1.10.Incl.Keygen-R2R\R2R\vcruntime140_1.dllexecutable
MD5:F38BBB2DCEA08BE0AE9E8C4447E9CD58
SHA256:A9D61D9FCEE0D83656757EB36A8586DE44D1E4F47BEBD13AFDBD474A47B82209
4692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR4692.17128\Rar$Scan36115.battext
MD5:6740CA4011529CB23F68526F1A17ACA9
SHA256:E0649EFA318400C1B33DC20F47BA67CE182102242EACF66991DCBD1C65B88818
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
45
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.71:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
400
20.190.159.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
400
20.190.159.4:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
200
40.126.31.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6024
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2292
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4572
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.0
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ableton-Keygens-DANGEROUS.7z