File name:

VegasPro_Installer.exe

Full analysis: https://app.any.run/tasks/097b3855-b6f6-4cf6-b2b3-adce34833944
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 05:57:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

12AEB438E121CC5BB171CB521303DA3F

SHA1:

D29BC21528221F4AA6892BB567D80FC56BDE592D

SHA256:

2D6D27EBE53C01CCDC4BF5E8EB90D90F8B49C6227AC5498B17AF0B251DEBA635

SSDEEP:

98304:0LVIF8P3n1BLHxtD59KEKjSvD3PuR6PI8Dh2hsC65uujV6AAdQ+FVMZlzVl5iUhP:4VaE2gIWbTX0Eh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • VegasPro_Installer.exe (PID: 7184)
      • VegasPro_Installer.exe (PID: 7364)
      • core.exe (PID: 7892)
      • patch.exe (PID: 7912)
      • ABE.exe (PID: 7952)
      • ABE.exe (PID: 7276)
      • Diagnosis.exe (PID: 5124)

    • Actions looks like stealing of personal data

      • patch.exe (PID: 7912)
      • ABE.exe (PID: 7952)
      • ABE.exe (PID: 7276)

    • Steals credentials from Web Browsers

      • patch.exe (PID: 7912)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VegasPro_Installer.exe (PID: 7184)
      • VegasPro_Installer.exe (PID: 7364)
      • VegasPro_Installer.tmp (PID: 7384)
      • patch.exe (PID: 7912)
      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)
      • core.exe (PID: 7892)

    • Reads security settings of Internet Explorer

      • VegasPro_Installer.tmp (PID: 7220)
      • core.exe (PID: 7892)
      • MxDownloadManager.exe (PID: 7216)

    • Reads the Windows owner or organization settings

      • VegasPro_Installer.tmp (PID: 7384)

    • Starts itself from another location

      • patch.exe (PID: 7912)

    • Executes application which crashes

      • ABE.exe (PID: 7952)
      • ABE.exe (PID: 7276)

    • The process executes via Task Scheduler

      • Diagnosis.exe (PID: 5124)

    • Loads DLL from Mozilla Firefox

      • patch.exe (PID: 7912)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • patch.exe (PID: 7912)

  • INFO

    • Checks supported languages

      • VegasPro_Installer.exe (PID: 7184)
      • VegasPro_Installer.tmp (PID: 7220)
      • VegasPro_Installer.exe (PID: 7364)
      • VegasPro_Installer.tmp (PID: 7384)
      • patch.exe (PID: 7912)
      • core.exe (PID: 7892)
      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)
      • ABE.exe (PID: 7952)
      • MxDownloadManager.exe (PID: 7216)
      • ABE.exe (PID: 7276)
      • Diagnosis.exe (PID: 5124)

    • Create files in a temporary directory

      • VegasPro_Installer.exe (PID: 7184)
      • VegasPro_Installer.exe (PID: 7364)
      • VegasPro_Installer.tmp (PID: 7384)
      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)
      • MxDownloadManager.exe (PID: 7216)

    • Reads the computer name

      • VegasPro_Installer.tmp (PID: 7220)
      • VegasPro_Installer.exe (PID: 7364)
      • VegasPro_Installer.tmp (PID: 7384)
      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)
      • core.exe (PID: 7892)
      • patch.exe (PID: 7912)
      • MxDownloadManager.exe (PID: 7216)
      • Diagnosis.exe (PID: 5124)

    • Process checks computer location settings

      • VegasPro_Installer.tmp (PID: 7220)

    • Creates files in the program directory

      • patch.exe (PID: 7912)
      • core.exe (PID: 7892)

    • The sample compiled with german language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with Italian language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with japanese language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with russian language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 8140)
      • MxDownloadManager.exe (PID: 7216)
      • WerFault.exe (PID: 7012)
      • core.exe (PID: 7892)

    • The sample compiled with korean language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with polish language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with portuguese language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with swedish language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • Reads the machine GUID from the registry

      • core.exe (PID: 7892)
      • MxDownloadManager.exe (PID: 7216)
      • patch.exe (PID: 7912)

    • The sample compiled with turkish language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with chinese language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with english language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with czech language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with spanish language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • The sample compiled with french language support

      • trial_vegaspro22_dlm_je96k4.exe (PID: 7872)

    • Checks proxy server information

      • MxDownloadManager.exe (PID: 7216)
      • core.exe (PID: 7892)

    • Reads the software policy settings

      • MxDownloadManager.exe (PID: 7216)
      • core.exe (PID: 7892)

    • Manual execution by a user

      • msedge.exe (PID: 3332)

    • Application launched itself

      • msedge.exe (PID: 4108)
      • msedge.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:03 14:45:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 704512
InitializedDataSize: 467456
UninitializedDataSize: -
EntryPoint: 0xacfe0
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: VegasPro
FileDescription: VegasPro Creative Setup
FileVersion:
LegalCopyright: Sony
OriginalFileName:
ProductName: VegasPro Creative
ProductVersion: VegasPro Creative
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
35
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start vegaspro_installer.exe vegaspro_installer.tmp no specs vegaspro_installer.exe vegaspro_installer.tmp trial_vegaspro22_dlm_je96k4.exe core.exe patch.exe abe.exe werfault.exe no specs mxdownloadmanager.exe abe.exe werfault.exe no specs diagnosis.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2800 --field-trial-handle=2524,i,2929154588321052122,8050151217559514867,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2524,i,2929154588321052122,8050151217559514867,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2904"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5276 --field-trial-handle=2524,i,2929154588321052122,8050151217559514867,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2960"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x310,0x314,0x318,0x308,0x320,0x7ffc89655fd8,0x7ffc89655fe4,0x7ffc89655ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3272"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2524,i,2929154588321052122,8050151217559514867,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://rdir.magix.net/?page=2IHNTLK9PAANC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4108"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rdir.magix.net/?page=2IHNTLK9PAANC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—MxDownloadManager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2520 --field-trial-handle=2524,i,2929154588321052122,8050151217559514867,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4284"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=2524,i,2929154588321052122,8050151217559514867,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 991
Read events
12 873
Write events
112
Delete events
6

Modification events

(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:ProgramId
Value:
0006bcde3400cf55f463c3a181dbf16a68780000ffff
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:FileId
Value:
00000e501c0122bf3c9f1c53eaff562d0fae67c260bd
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:LowerCaseLongPath
Value:
c:\program files\google\chrome\application\abe.exe
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:LongPathHash
Value:
abe.exe|30a3f50397c0a86f
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:Name
Value:
ABE.exe
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:OriginalFileName
Value:
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:Publisher
Value:
(PID) Process:(8140) WerFault.exeKey:\REGISTRY\A\{109e8a11-4f6a-b4e2-fc37-44ae4cf76a5a}\Root\InventoryApplicationFile\abe.exe|30a3f50397c0a86f
Operation:writeName:Version
Value:
Executable files
54
Suspicious files
91
Text files
47
Unknown types
1

Dropped files

PID
Process
Filename
Type
7384VegasPro_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-6SDGG.tmp\core.exeexecutable
MD5:FA6C9168DEF75CD95DD85162F6DAC1F4
SHA256:E2D52C4C5548E0319F92EB9B83818D4D53C5B05C98167BE2AEB593BF1F973D81
7184VegasPro_Installer.exeC:\Users\admin\AppData\Local\Temp\is-ECIIM.tmp\VegasPro_Installer.tmpexecutable
MD5:4880C7A6BF93B460B38688E89B94478B
SHA256:2B98CC8DBFF1CE10D8F26DAE4A65579F88C9CCD18441A690DBD0FA9974C788C3
7364VegasPro_Installer.exeC:\Users\admin\AppData\Local\Temp\is-KR6HQ.tmp\VegasPro_Installer.tmpexecutable
MD5:4880C7A6BF93B460B38688E89B94478B
SHA256:2B98CC8DBFF1CE10D8F26DAE4A65579F88C9CCD18441A690DBD0FA9974C788C3
7384VegasPro_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-6SDGG.tmp\is-81QQD.tmpexecutable
MD5:FA6C9168DEF75CD95DD85162F6DAC1F4
SHA256:E2D52C4C5548E0319F92EB9B83818D4D53C5B05C98167BE2AEB593BF1F973D81
7384VegasPro_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-6SDGG.tmp\trial_vegaspro22_dlm_je96k4.exeexecutable
MD5:BDA5C4879E84F420ABE197FAFD1D2448
SHA256:7B50903C2FC17BC13240D986DE6C32EFDBA0882223792107EFDE64F48D47D64E
7384VegasPro_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-6SDGG.tmp\is-IHVUB.tmpexecutable
MD5:A081885676E3AAF9860EE07143E5F875
SHA256:63B17BD23DD65B15C530BA21657F8D745246CF40124D3FEA2C025DB24542DC4A
7384VegasPro_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-6SDGG.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7384VegasPro_Installer.tmpC:\Users\admin\AppData\Local\Temp\is-6SDGG.tmp\is-4JUK6.tmpexecutable
MD5:BDA5C4879E84F420ABE197FAFD1D2448
SHA256:7B50903C2FC17BC13240D986DE6C32EFDBA0882223792107EFDE64F48D47D64E
7872trial_vegaspro22_dlm_je96k4.exeC:\Users\admin\AppData\Local\Temp\mgxun1i4wdo\Bitmaps\mxgui.4.0\generalTemplates.INItext
MD5:D8ACCCB39FA2BCBC59AE3B7D26B1BC6F
SHA256:C1DE2A676BF7C42F2626A7F9DD63B79774E8D8D39D3716D4E14372172B816608
7872trial_vegaspro22_dlm_je96k4.exeC:\Users\admin\AppData\Local\Temp\mgxun1i4wdo\Bitmaps\mxgui.4.0\Logo.pngimage
MD5:0E4712A4E4EBA8B6B6829CA21FD6DEF8
SHA256:63A0002EFBBB5698778CA16E61CD47654450614423BBD75D20F3F6E2BC3AC8AD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
75
DNS requests
82
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5972
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7216
MxDownloadManager.exe
GET
301
195.214.216.160:80
http://www.magix.com/
unknown
—
—
whitelisted
5972
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7216
MxDownloadManager.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7216
MxDownloadManager.exe
GET
200
184.24.77.83:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgRJRUJNZnR7muc%2BEDgXwwLhsw%3D%3D
unknown
—
—
whitelisted
7216
MxDownloadManager.exe
GET
301
195.214.216.160:80
http://www.magix.com/user/client_redirects/service_api/extservices_crp.utf8.php
unknown
—
—
whitelisted
7216
MxDownloadManager.exe
GET
301
195.214.216.160:80
http://www.magix.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5024
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.65
  • 40.126.32.68
  • 40.126.32.74
  • 20.190.160.131
  • 40.126.32.138
  • 20.190.160.67
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
www.magix.com
  • 195.214.216.160
whitelisted

Threats

PID
Process
Class
Message
7912
patch.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7912
patch.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
616
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
616
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7912
patch.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
616
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
616
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VegasPro_Installer.exe